System and method for situational awareness, vehicle control, and/or contingency planning

ABSTRACT

A method, preferably including: sampling inputs, determining aircraft conditions, and/or acting based on the aircraft conditions. A method, preferably including: sampling inputs, determining input reliability, determining guidance, and/or controlling aircraft operation. A method, preferably including: operating the vehicle, planning for contingencies, detecting undesired flight conditions, and/or reacting to undesired flight conditions. A system, preferably an aircraft such as a rotorcraft, configured to implement the method.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of U.S. Provisional Application Ser.No. 62/537,691, filed on 27 Jul. 2017, U.S. Provisional Application Ser.No. 62/544,161, filed on 11 Aug. 2017, U.S. Provisional Application Ser.No. 62/544,172, filed on 11 Aug. 2017, U.S. Provisional Application Ser.No. 62/607,230, filed on 18 Dec. 2017, and U.S. Provisional ApplicationSer. No. 62/634,719, filed on 23 Feb. 2018, each of which isincorporated in its entirety by this reference.

TECHNICAL FIELD

This invention relates generally to the vehicle field, and morespecifically to a new and useful system and method for situationalawareness and/or vehicle control.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a flow chart representation of a first embodiment of themethod.

FIG. 2 is a schematic representation of a first variation of the systemand method.

FIG. 3 is a schematic representation of a specific example of themethod.

FIG. 4 is a schematic representation of a method for dynamicallygenerating a safety corridor.

FIG. 5 is a flow chart representation of a second embodiment of themethod.

FIG. 6 is a schematic representation of a second variation of the systemand method.

FIG. 7 is a flow chart representation of a third embodiment of themethod.

FIG. 8A is an example of a height-velocity curve.

FIG. 8B is an example of an aircraft glide path.

FIG. 9 is a schematic representation of an example control architecture.

FIG. 10 is a schematic representation of an example of reactionevaluation.

FIG. 11 is a flow chart representation of a fourth embodiment of themethod.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

The following description of the preferred embodiments of the inventionis not intended to limit the invention to these preferred embodiments,but rather to enable any person skilled in the art to make and use thisinvention.

1. Overview.

An embodiment 3 of a method (e.g., for situational awareness) preferablyincludes sampling inputs S310, determining aircraft conditions S330, andacting based on the aircraft conditions S340, and can optionally includedetermining input correlations S320 and/or collecting additionalinformation S350 (e.g., as shown in FIGS. 1-2). An embodiment 4 of themethod (e.g., for vehicle control) preferably includes sampling inputsS410, determining input reliability S430, determining guidance S440, andcontrolling aircraft operation S450, and can optionally includedetermining expected input characteristics S420 (e.g., as shown in FIGS.5-6). An embodiment 6 of the method (e.g., for contingency planning)preferably includes operating the vehicle S610, planning forcontingencies S620, detecting undesired flight conditions S630, andreacting to undesired flight conditions S640 (e.g., as shown in FIG. 7).

The method is preferably performed throughout aircraft operation (e.g.,continuously, periodically, sporadically, etc.; during aircraft flight,in preparation for and/or following flight, at all times, etc.). One ormore (e.g., any or all) of the embodiments can be performed, preferablywherein embodiments for situational awareness, vehicle control, andcontingency planning are all performed. The embodiments can be performedconcurrently, consecutively, in alternation, interleaved, and/or withany other suitable timing relative to each other. The embodiments canoptionally share elements (e.g., wherein sampling inputs is performedfor both the embodiment 3 for situational awareness and the embodiment 4for vehicle control, such as shown in FIG. 11), and/or the elements ofthe different embodiments can be combined in any suitable manner.However, any or all of the embodiments (and/or elements thereof) canadditionally or alternatively include any other suitable elements,and/or can be performed with any other suitable timing.

2. Benefits.

The vehicle system and/or method can confer several benefits. First,embodiments of the system and/or method can enable safe, reliable,consistent, fully-autonomous aircraft operation, such as by performingsituational assessments of aircraft conditions and making decisionsbased on the conditions in order to optimize for low risk, highperformance, and/or other mission goals. Second, embodiments of thesystem and/or method can supplement, replace, and/or improve upon thesituational awareness of an experienced human operator (e.g., on-boardpilot, remote operator, etc.), preferably including the ‘fuzzy’evaluations (e.g., ‘gut feelings’) of such an operator. In examples,these embodiments can include: highlighting potentially-importantinformation for the operator, prompting the operator for specificdecisions and/or other information, cross-checking (and/or helping theoperator to cross-check) various inputs, and/or any other suitablesituational awareness enhancements. Third, embodiments of the systemand/or method can enable training and/or assistance of less experiencedhuman operators, such as by: segmenting responsibilities between theoperator and autopilot modules (e.g., according to a training programthat progressively assigns greater responsibility to the humanoperator), prompting the operator to act based on the aircraftconditions and/or instructing the operator on the correct or suggestedaction, assuming control when issues arise beyond the operator's skill(e.g., acting as a ‘safety net’ for the human operator), monitoringand/or assessing the operator's abilities, and/or performing any othersuitable training aspects. Fourth, embodiments of the system and/ormethod can inform algorithms for defining a safety corridor throughwhich the vehicle can traverse, based on statuses systems of the vehiclein relation to external factors (e.g., associated with weather,associated with terrain, associated with traffic, associated with noise,associated with disturbance of populations within range of the vehicle,etc.).

Second, embodiments of the system and/or method can potentially offerrobust sensor redundancy and/or input-type redundancy, beyond justimplementing voting-like decision techniques for identical and/orsimilar sensors and sensor types. The system and/or method can form agreater understanding of the system state and the state of its sensors(and other information input sources), and can compensate for the lossof some inputs by generating complementary information based on otherinputs. This can be achieved by using many different kinds of sensorsand other input sources (e.g., leveraging machine learning techniques todetermine correlations between the sensors, and generating informationsuch as predictions based on those correlations). For example, anembodiment of the system could lose almost any sensors from the set ofradar, IMU, cameras, ultrasonic, GPS, and on-board diagnostics, and yetstill fly safely using the remaining sensors, based on historicalcorrelations between the sensors (e.g., using simultaneous localizationand mapping).

Third, embodiments of the system and/or method can potentially offerrobust guidance determination and/or autopilot redundancy. Byindependently making guidance and/or control decisions (e.g., usingdifferent inputs, different algorithms, independent processing hardware,etc.), embodiments of the system and/or method can be highly resistantto failure arising from unexpected (e.g., emergent) behavior.

Fourth, embodiments of the system and/or method can potentially beresistant to pilot errors. By evaluating pilot control inputs (e.g.,along with other inputs such as sensor inputs), the system and/or methodcan detect signs of pilot failure and/or determine potentialconsequences of pilot commands, and can override the pilot if desired(e.g., to avert or recover from potentially-dangerous flight conditions,to optimize vehicle and/or mission performance, etc.).

Fifth, embodiments of the system and/or method can potentially increasesafety (e.g., for the vehicle, vehicle occupants, vehicle cargo, othervehicles, other people and/or property, etc.) while enabling autonomous(e.g., fully autonomous, partially autonomous) performance of vehiclemissions. The system and/or method can include planning ahead for manypotential contingencies (e.g., undesired flight conditions such asemergency conditions, inefficient conditions, off-nominal conditions,etc.), optionally altering normal vehicle operation in order to improvethe expected outcomes in case of such contingencies. For example, thiscan include enabling rapid, effective response to and/or resolution ofundesired vehicle conditions.

However, the system and/or methods can additionally or alternativelyconfer any other suitable benefits.

3. System.

The method is preferably performed using an aerial vehicle system (e.g.,the systems described in U.S. application Ser. No. 15/643,205, titled“Vehicle System and Method for Providing Services”, which is hereinincorporated in its entirety by this reference; the system describedbelow; etc.). The aerial vehicle system (e.g., aircraft) is preferably arotorcraft (e.g., helicopter), but can additionally or alternatively bea fixed-wing aircraft and/or any other suitable aircraft.

The aircraft preferably includes one or more propulsion mechanisms(e.g., rotors, propellers, fans, jet engines such as airbreathing and/orrocket engines, etc.), power plants (e.g., motors) configured to drivethe propulsion mechanisms (e.g., internal combustion engines, electricmotors, etc.), and/or flight control surfaces (e.g., rotor blades,elevators, ailerons, rudders, flaps, etc.).

The aircraft preferably includes one or more sensors. The sensors caninclude one or more: radar sensors, lidar sensors, sonar sensors,cameras (e.g., CCD, CMOS, multispectral, visual range, hyperspectral,stereoscopic, etc.), spatial sensors (e.g., inertial measurementsensors, accelerometer, gyroscope, altimeter, magnetometer, etc.),location sensors (e.g., GPS, GNSS, triangulation, trilateration, etc.),force sensors (e.g., strain gauge meter, load cell), on-board diagnosticsensors such as aircraft mechanism sensors (e.g., sensing status ofmechanisms such as rotors, control surfaces, engines, inputs, linkages,actuators, etc.; configured to sense position, force, speed,temperature, pressure, fluid quantity, etc.) and/or aircraft environmentsensors (e.g., configured to sense cabin temperature, air pressure,oxygen concentration, indications of fire such as smoke and/orparticulates, etc.), audio sensors (e.g., transducer, microphone, etc.),barometers, light sensors, temperature sensors, current sensors (e.g.,Hall effect sensor), air flow meters, voltmeters, touch sensors (e.g.,resistive, capacitive, etc.), proximity sensors, vibration sensors,chemical sensors, ultrasound sensors (e.g., ultrasound transducersand/or receivers), electrical sensors (e.g., impedance and/or continuitysensors), sensors configured to detect mechanical wear (e.g., fatigue,fractures such as sub-surface fractures, etc.), and/or any othersuitable sensors. The sensors can optionally be classified based onpriority (e.g., primary sensors, secondary sensors, tertiary sensors,etc.). In one example, the radar sensors of the aircraft are classifiedas primary sensors, and all other sensors of the aircraft are classifiedas secondary sensors. However, the aircraft can additionally oralternatively include any other suitable sensors, and/or can classifythe sensors in any other suitable manner (and/or not classify thesensors).

For instance, in relation to arrays of motors and/or propulsion systems(e.g., as in a vertical-takeoff-and-landing system), the system canimplement sensors for monitoring power efficiency characteristics (e.g.,in relation to rotational speed, blade pitch, and/or power delivered;possibly including a ratio between rotor speed and power delivered tothe rotor) of each motor involved in a given maneuver. Outputs of suchsensors can then be used to determine if the system is behaving in anexpected manner for the maneuver, in relation to known aircraftconditions (e.g., the current maneuver), environmental conditions,and/or any other suitable conditions.

In one example, the aircraft includes sensors, such as lidar and/orcameras, that are configured to sense information indicative of thestatus of external aircraft elements, such as moving and/or moveablecomponents (e.g., control surfaces, landing gear, etc.). For example,the sensors can be configured to detect component position (and/orposition of control elements configured to control and/or maintaincomponent positions), component irregularities (e.g., damage, actuationproblems, etc.), and/or other aspects of components such as the controlsurfaces. However, the aircraft can additionally or alternativelyinclude any other suitable sensors.

The aircraft preferably includes one or more communication modules(e.g., wireless communication modules, such as radios). The radios canbe configured to receive and/or transmit ADS-B information, air trafficcontrol (ATC) information, ground station network information, and/orany other suitable information. The radios are preferably configured tocommunicate (e.g., via direct radio transmission, via one or more relaysand/or other intermediaries, such as satellites, etc.) with the groundstation network, ATC centers, other aircraft, and/or any other suitableendpoints (e.g., using voice and/or data communication).

The aircraft can optionally include human control inputs (e.g., pilotcontrols, operator controls, layman controls, etc.). The inputs can beon-board and/or remote (e.g., received through a communication module).The inputs can include traditional manual inputs (e.g., yoke and/orstick such as cyclic stick, pedals, throttle control, collective, etc.),autopilot inputs (e.g., desired destination, heading, altitude,attitude, speed, etc.), alternative inputs (e.g., simplified commandinputs such as abort, avoid obstacle straight ahead, etc.), and/or anyother suitable human control inputs.

The aircraft can include a plurality of processors, preferablyindependent physical processors, but additionally or alternativelyvirtual processors (e.g., implemented on one or more physicalprocessors). Each processor of the plurality preferably has segregatedresponsibilities (e.g., separated and/or sandboxed from the otherprocessors). For example, the aircraft can include separate processorsto perform one or more of: receiving and/or analyzing inputs (e.g., frominput sources such as sensors, communication modules, human controlinputs, etc.), determining guidance (e.g., flight control guidance)based on inputs from one or more of the input sources, determiningdesired flight control behavior based on the determined guidance(s)(e.g., multiplex the guidances determined based on different inputs),and/or controlling aircraft operation (e.g., based on the desired flightcontrol behavior); and/or separate processors to implement one or moremodules of the aircraft control architecture (e.g., as described below),such as an independent processor for each of: the mission planner, thecontingency manager, the state estimator, and the mission executor. Theprocessors can be: CPUs (e.g., with one or more cores), GPUs, TPUs,microprocessors, and/or any suitable processors. Additionally oralternatively, the aircraft can include a single processor, noprocessors, or any other suitable number of processors of any suitabletype(s). The aircraft can optionally include memory (e.g., Flash, RAM)that stores data (e.g., compute modules, such as planners and managers,etc.; sensor data; flight data; time-series confidence data, state data,sensor data, etc.; mission data; etc.) accessible by the processor,which can be on-board or remote from the aircraft. In one variation,each section and/or component of the control architecture can have anindependent processing system, including one or more processors andmemory. Alternatively, different control architecture components canshare processors (e.g., wherein the processor can be entirely shared orsegmented by core or thread), memory, or other hardware components.

The aircraft can optionally include one or more recording modules (e.g.,flight recorders, such as flight data recorders and/or cockpit voicerecorders). The recording modules preferably function to log and/orstore aircraft flight data. Aircraft flight data can include the inputs(e.g., sampled as described below regarding S310 and/or S410), guidance(e.g., determined as described below regarding S440), computationalinputs, outputs, and/or intermediary states (e.g., generated asdescribed below regarding the method), and/or any other suitableinformation. The recording modules are preferably capable ofwithstanding the conditions encountered in a severe aircraft accident(e.g., as specified by EUROCAE ED-112). However, the recording modulescan additionally or alternatively perform any other suitable function.

The aircraft can optionally include one or more safety systems (e.g., asdescribed in U.S. application Ser. No. 15/903,996, titled “Safety Systemfor Aerial Vehicles and Method of Operation”, and/or U.S. applicationSer. No. 15/904,082, titled “Safety System for Aerial Vehicles andMethod of Operation”, each of which is hereby incorporated in itsentirety by this reference). For example, the aircraft can includesecondary (e.g., redundant, emergency, temporary, etc.) propulsionmechanisms (e.g., retro-rockets, secondary powerplants and/or rotors,etc.), ballistic parachutes, and/or any other suitable safety systems.The safety systems can function to provide one or more safety mechanisms(e.g., “last-resort” safety mechanisms) for the aircraft, aircraftcontents, and/or aircraft surroundings. For example, one or more of thesafety systems can be deployed (e.g., retro-rockets fired, parachuteunfurled and/or otherwise deployed, etc.) in order to reduce the dangersassociated with an imminent aircraft collision (e.g., collision with theground, such as following a loss of propulsion and/or flight control),such as dangers of morbidity, mortality, and/or equipment damage. In onevariant, the aircraft can include an electric motor configured to driveone or more aircraft rotors (e.g., main rotor, backup rotor, etc.),propellers, and/or other propulsion elements, and can include a batteryconfigured to power the electric motor (e.g., electrically coupled tothe motor), which can enable short-term rotor operation even if theprimary aircraft powerplant (e.g., fuel-powered engine) fails (e.g.,during flight).

The safety systems can additionally or alternatively include one or moreimpact attenuators (e.g., crumple zones). For example, a protectedcompartment (e.g., passenger cabin) of the aircraft can be highly rigid,and other structures of the aircraft can be more compliant and/orfrangible (e.g., increasing compliance and/or frangibility farther fromthe protected compartment), such that the compliant and/or frangiblestructures can absorb energy during an aircraft collision. The safetysystems can additionally or alternatively include one or more rotorseizing mechanisms, which can be operable to slow rotor rotation (e.g.,rapidly slow and/or stop). In one example, the rotor seizing mechanismscan consistently, quickly, and repeatably slow the rotors (e.g., to astop) upon aircraft landing. In a second example, the rotor seizingmechanisms can additionally or alternatively perform a catastrophicrapid rotor shutdown if necessary or desired. In a specific example ofcatastrophic rapid rotor shutdown, in response to determining that anobject (e.g., a human) may collide with the rapidly spinning rotor(e.g., is likely to collide, such as more than a threshold probabilityof collision; could possibly collide; is near; etc.), the rotor seizingmechanisms (e.g., including a crumpling brake fixture) can cause therotors to retract and/or seize, thereby preventing the collision and/orreducing the ensuing collision damage. However, the aircraft canadditionally or alternatively include any other suitable safety systems,and/or can omit such systems. Actuation of the safety mechanisms and/orother components discussed above is preferably controlled by the missionexecutor (e.g., based on instructions from the mission planner and/orcontingency manager), but can alternatively be remotely controlled(e.g., based on commands received from a remote operator, ground controlstation, air traffic controller, etc.), passively actuated (e.g., byairflow, etc.), manually controlled (e.g., via the human controlinputs), or otherwise controlled.

In some examples, the system contains one or more occupants (e.g.,humans, preferably living humans) during performance of some or allelements of the method. In some specific examples (e.g., in which thesystem contains occupants), the system does not contain any pilots(e.g., licensed pilot, unlicensed pilot, system operator, etc.) and/ordoes not receive control inputs from any pilots. However, the system canadditionally or alternatively contain any other suitable occupants,and/or can contain no such occupants.

Although elements of the method are described as performed using anaircraft, a person of skill in the art will understand that the method(and optionally, any or all such elements of the method) canadditionally or alternatively be performed using any other suitablesystem. For instance, the method can additionally or alternatively beperformed using terrestrial vehicles (e.g., cars, road-going ambulances,etc.), amphibious vehicles, aquatic vehicles, space vehicles, or acombination of vehicle types.

4. Situational Awareness. 4.1 Sampling Inputs.

Sampling inputs S310 preferably functions to collect information thatcan inform aircraft operation (e.g., flight control). The inputs can besampled from sensors (e.g., from on-board sensors, remote sensors,etc.), communication modules (e.g., transmissions received by thecommunication modules, such as ADS-B information, ATC information,contextual information such as weather, communications from otheraircraft, NOTAMs, etc.), human control inputs (e.g., flight controlinputs such as cyclic stick or yoke adjustments), historical aircraftinformation (e.g., age, workload, maintenance record, possible problems,etc.), information determined during aircraft inspections (e.g., duringpre-flight and/or post-flight checks, such as the most recent pre-flightcheck), and/or any other suitable inputs. For example, S310 can include,at each of a plurality of inputs (e.g., sensors of the aircraft, otherinputs, etc.), sampling (e.g., substantially concurrently) respectivesets of data (e.g., flight data).

Sampling inputs S310 can additionally or alternatively include receivinginformation from vehicle occupants (e.g., crew, passengers, etc.). Theinformation can be determined (e.g., by the occupant) based on occupantsensory observations (e.g., touch, smell, vision, hearing, etc.),perceptions, and/or any other suitable information. S310 can optionallyinclude requesting the information from the occupant (e.g., asking ifthe occupant detects an abnormal odor; asking the occupant to check if aparticular wire is frayed, a particular fuse is blown, a particular boltis loose, a particular structural member shows signs of fatigue, aparticular structural member shows signs of corrosion, etc.; asking theoccupant if any of the passengers are behaving unusually; asking theoccupant is they detect an abnormal sounds, etc.), wherein theinformation can be received in response to the request. For example, ifother inputs (e.g., inputs automatically sampled from aircraft sensors)indicate a potential issue (e.g., determined in S330), the method caninclude requesting information associated with the potential issue fromthe occupants. However, the information can additionally oralternatively be received from the occupant(s) at any suitable timeand/or in response to any suitable trigger (or no trigger at all).

The inputs are preferably sampled continuously, but can additionally oralternatively be sampled periodically, sporadically, and/or with anyother suitable timing. The inputs can be sampled during aircraft flight,before flight (e.g., for a pre-flight safety check), after flight (e.g.,for a post-flight damage assessment), and/or at any other suitable time.

The inputs are preferably sampled and/or processed by multipleindependent processors (e.g., each processor dedicated to a singlesensor, sensor type, sensor class, and/or other sensor subset), but canalternatively be sampled by a single processor, or the samplingresponsibilities can be otherwise distributed. The processors arepreferably all on-board the aircraft, but alternatively some or allprocessors can be remote to the aircraft (e.g., wherein processoroutputs are received by an aircraft communication module).

4.2 Determining Input Correlations.

Determining input correlations S320 preferably functions to enabledetermination of aircraft conditions (e.g., detection of typical,unusual, and/or potentially dangerous aircraft conditions) based on thecorrelations. The correlations preferably include sensor-aircraftcondition correlations (e.g., correlations between one or more sensorreadings and the associated aircraft conditions) and/or inputself-correlations (e.g., expected temporal trends), but can additionallyor alternatively include any other suitable correlations.

The aircraft conditions can include desired (e.g., ideal, efficient,safe, acceptable, typical, etc.) and/or undesired (e.g., inefficient,uncomfortable, dangerous, atypical, etc.) conditions, and preferablyinclude classifications (and/or other characterizations) of specificconditions (e.g., classification as desired or undesired; more specificclassification, such as the sub-classes described above; severityclassifications and/or other ratings; etc.). The aircraft conditions caninclude conditions related to aviation, navigation, risk mitigation,aircraft equipment, occupants (e.g., passengers, personnel, other livingoccupants), remote operators, regulation compliance, efficiency, missionobjectives (e.g., satisfaction thereof), and/or any other suitableconditions. For example, aircraft conditions can include informationregarding control surfaces, powertrains (e.g., engines, transmissions,rotors, etc.), fuel systems, landing systems, avionics, structuralintegrity, forces, stresses, and/or strains, collision threats (e.g.,terrain, traffic, other obstacles, etc.), environmental conditions(e.g., weather), and/or any other suitable information regarding theaircraft and/or aircraft flight.

The correlations can be determined based on sampled inputs (e.g.,sampled during S310, previously sampled, etc.), simulated data (e.g.,finite element modeling results, such as for expected mechanical strainunder specified flight conditions), historical data (e.g., from the sameaircraft, same and/or similar aircraft types, and/or any suitableaircraft or other data sources), aircraft component properties (e.g.,resonant frequencies), and/or any other suitable information.

The correlations can be determined concurrent with and/or following(e.g., immediately, after a delay time, etc.) sampling the inputs S310,prior to sampling the inputs S310 (e.g., determined based on historicaldata concurrent with and/or following sampling of the historical data),and/or with any other suitable timing.

The correlations can be represented (e.g., for storage, transmission,processing, etc.) as functions (e.g., correlating two or more inputvalues over a functional form such as a surface), neural networks suchas convolutional neural networks (e.g., wherein S320 includes trainingthe neural networks), Bayesian networks, Markov chains and/or controlpolicies, probability distributions, heuristics, and/or can have anyother suitable representation. The correlations can be determined usingmachine learning and/or statistical techniques (e.g., regression,classification, clustering, etc.), determined based on human inputs(e.g., human-defined heuristics, threshold values, and/or correlations,etc.), and/or determined in any other suitable manner. For instance,training of machine learning algorithms can be based upon trainingdatasets generated with involvement from entities experienced in flightand/or operations of the vehicle(s) associated with the method, therebyleveraging experience of those for whom situational awareness duringvehicle operations has become innate. Machine learning and/orstatistical techniques can, however, be implemented in any othersuitable manner.

The correlations can be determined on-board (e.g., by an on-boardprocessor, such as a processor used to sample inputs S310, a differentprocessor, etc.), remotely (e.g., by a remote processor), and/or by anyother suitable components. Determining the correlations S320 canadditionally or alternatively include receiving the correlations (e.g.,at the aircraft, from a remote server such as at a ground station). Thereceived correlations are preferably determined by the transmitter(e.g., the ground station), but can additionally or alternatively bedetermined by any other suitable entities (e.g., computing systems,human operators, etc.). The received correlations can be determined(e.g., as described above and/or otherwise) substantially concurrentwith transmission (e.g., immediately before transmission), prior totransmission (e.g., based on historical data), and/or with any othersuitable timing.

In one variant, inputs including audio (e.g., frequency components ofaudio data, such as data indicative of resonant frequencies of aircraftelements and/or otherwise characteristic frequencies), strain,acceleration, rotation rate, and/or heading are correlated withconditions such as aircraft component movement (e.g., rotor operation,engine operation, control surface position and/or movement, structuralmember vibration, fastener movement, etc.), mechanical forces within theaircraft (e.g., exerted on structural and/or functional members of theaircraft), and/or aircraft motion. The inputs can be sampled by sensors(e.g.; microphones, preferably multiple microphones arranged throughoutthe aircraft, thereby providing spatially-resolved audio information(e.g., determined based on relative intensity, trilateration,triangulation, multilateration, etc.); strain gauges; IMUs; etc.), suchas sensors of the aircraft, other aircraft, and/or test rigs, can besimulated (e.g., using computerized modeling techniques such as finiteelement modeling), and/or determined in any other suitable manner. Inone example, audio data (e.g., spatially-resolved audio data, frequencycomponents of audio data, etc.) is correlated with power plant and/orflight control surface operation (e.g., in relation to engine operation,etc.). However, S320 can additionally or alternatively includedetermining any other suitable correlations.

4.3 Determining Aircraft Conditions.

Determining aircraft conditions S330 preferably functions to determine(e.g., detect, predict, etc.) potential issues, such as aircraftconditions that may be undesired and/or problematic, and canadditionally or alternatively function to detect typical, acceptableand/or desired aircraft conditions. Aircraft conditions can bedetermined based on the inputs (e.g., sampled in S310), the inputcorrelations (e.g., determined in S320), and/or previous aircraftconditions determinations (e.g., potential issues determined in previousperformances of S330, other aircraft conditions determined based oninput correlations and/or in any other suitable manner, etc.). Theaircraft conditions are preferably determined in response to determining(and/or receiving) the inputs and/or input correlations (e.g.,concurrent with sampling the inputs).

For example, based on (e.g., preferably in response to sampling) adataset (e.g., sampled in S310, such as at one or more sensors of theaircraft) indicative of an undesired condition (e.g., associated withone or more flight control elements of the aircraft, such as a flightcontrol surface, propulsion mechanism, etc.), S330 can includedetermining existence of the undesired condition (e.g., determining thatthe flight control element(s) are in the undesired condition). Thedataset can be indicative of an undesired condition when: the datasetvalue set (and/or elements thereof) substantially matches apredetermined pattern associated with an undesired condition (and/ordoes not substantially match any predetermined patterns associated withdesired conditions, which can be indicative of an unknown condition),one or more values of the dataset fall below (or exceed) a predeterminedthreshold, a score calculated from the dataset value(s) satisfies acondition associated with the undesired condition, and/or is otherwisedetermined to be indicative of the undesired condition. In someexamples, S330 can additionally or alternatively include determiningthat one or more additional datasets (e.g., associated with otherinputs, such as other types of sensors) are indicative of and/orconsistent with (e.g., not substantially conflicting with adetermination of the existence of) the undesired condition.

The aircraft conditions can be determined continuously, periodically,sporadically, in response to occurrence of a trigger (e.g., extremevalue, other aircraft conditions determination, receiving a human inputtrigger, etc.), and/or with any other suitable timing. Aircraftconditions are preferably determined during aircraft flight, but canadditionally or alternatively be determined before flight (e.g., duringa pre-flight check), after flight (e.g., during a post-flightinspection), and/or at any other suitable time.

Aircraft conditions are preferably determined on-board the aircraft(e.g., by one or more on-board processors, such as the processors thatperform S320 and/or different processors), but can additionally oralternatively be determined remotely (e.g., by a remote processingsystem, such as based on inputs transmitted from the aircraft to theremote processing system, wherein the determinations are subsequentlytransmitted to the aircraft).

Aircraft conditions can be determined using machine learning and/orstatistical techniques (e.g., as described above regarding S320, such asusing a neural network trained in S320), heuristic techniques, based onhuman inputs (e.g., operator assessments of aircraft conditions), and/orin any other suitable manner. S330 can optionally include determining(e.g., associated with a specific aircraft condition determined in S330,associated with the overall status of the aircraft, etc.) one or more:classifications (e.g., typical, atypical, desired, undesired, known,unfamiliar, etc.; classifications such as described above regardingS320), confidence values (e.g., likelihood that the classification iscorrect), qualitative and/or quantitative assessments (e.g., of acharacteristic of the determined aircraft condition(s), such asinefficiency, risk, etc.; determined by a regression and/orclassification technique, aircraft dynamics calculation, fuelconsumption calculation, risk assessment calculation, etc.), and/or anyother suitable aircraft status characterizations. For example, S330 caninclude determining the severity associated with the aircraftconditions, such as by scoring or ranking the potential issuesassociated with the conditions (e.g., categorizing the issues andranking them based on predetermined category rankings, scoring based onpredicted negative and/or positive impacts, etc.). In a specificexample, imminent terrain collisions may be categorized as very highseverity, power plant failures and passenger heart attacks may becategorized as high severity, electrical system failures and imminentbird strikes may be categorized as moderate severity, minor fuelinefficiencies may be categorized as low severity, and passenger anxietymay be categorized as very low severity. However, the aircraft conditionseverity can additionally or alternatively be determined in any othersuitable manner (or not be determined).

Unfamiliar conditions (e.g., the presence of unfamiliar inputs and/orcombinations of inputs) likely represent atypical (e.g., and thereforeundesired) aircraft status (e.g., indicative of a potential issue), butthe particular conditions associated with the aircraft status areunknown (e.g., and therefore the potential consequences and/orappropriate corrective actions are also unknown). Such unfamiliarconditions may merit or require sampling additional inputs (e.g., suchas described above regarding S310; which may enable more accurate and/orspecific determination of the aircraft condition) and/or performingcorrective actions (e.g., such as described below regarding S340),although in some cases the appropriate actions to take in response todetermining the unfamiliar conditions may not be known. S330 canoptionally include determining (or attempting to determine) the severity(e.g., likely severity, worst-case severity, probabilistic severitydistribution, etc.) of the potential issue(s) associated with theunfamiliar conditions (e.g., taking conservative corrective actions,such as safety system deployment and/or emergency landing, in responseto high-risk conditions; taking minimal or no corrective action inresponse to low-risk conditions). However, unfamiliar conditions canadditionally or alternatively be handled in any other suitable manner.

Determining aircraft conditions S330 preferably includes determining oneor more specific issues (e.g., possible, probable, and/or imminentevents such as collisions, low fuel conditions, equipment failures,and/or passenger medical condition deterioration; optimizationconsiderations such as route, speed, and/or efficiency; etc.) associatedwith the aircraft conditions (e.g., for atypical, undesired, and/orproblematic conditions). However, S330 can additionally or alternativelyinclude determining a type or classification of the issues, such asaviation, navigation, communication, human-related, aircraft equipmentsuch as electrical and/or mechanical (e.g., control surface actuation,structural failure, etc.); spatial regions associated with the issues(e.g., upper left portion of the aircraft frame); severity of the issue(e.g., as described above); inputs associated with (e.g., indicative of)the issue; and/or any other suitable information associated with theissues, or can include determining no information associated with theissues.

Aviation issues can include: stalled condition or imminent stall risk(e.g., pitching up, aileron stall, rolling into a tip stall, etc.), spinrisk, imminent collision (e.g., determined based on a collisionavoidance system such as TCAS; collision with traffic, terrain, etc.),uncoordinated flight (or, lack of desired forward- and/or side-slip,such as when appropriate during landing), rotor efficiency (e.g., foreach of a set of rotors of the aircraft, based on the current maneuver,weather conditions, etc.), and/or any other suitable aviation issues.

Navigation issues can include: failure to track a desired course (e.g.,incorrect position, heading, attitude, airspeed, ground speed, altitude,vertical speed, etc.), inadvisability of a planned and/or current course(e.g., due to weather, terrain, traffic, restricted and/or closedairspace, bird flocks, etc.), problematic (e.g., conflicting, dangerous,etc.) instructions (e.g., simultaneous takeoff and/or landing clearanceson crossed runways, instructions to fly toward terrain, hold and/ordivert instructions given to aircraft with insufficient fuel to safelycomply, etc.), such as problematic instructions received from ATC,ground stations, other aircraft, and/or any other suitable entities,and/or any other suitable navigation issues. In one example, a coursetracking issue can be determined based on a discrepancy between aircraftheading data (e.g., determined based on magnetometer readings,controlled by an autopilot system, etc.) and location data (e.g.,determined using GPS, determined based on nearby transponders and/orother landmarks, etc.).

Communication issues can include: failure (of the aircraft and/or otheraircraft, such as nearby aircraft) to respond to radio calls, requestclearances, and/or comply with ATC instructions; blocked frequenciesand/or bands (e.g., indicative of jamming); unreachable counterparties;and/or any other suitable communication issues.

Human-related issues (e.g., occupant state data) can include pilot orcontroller condition (e.g., panic, injury, hypoxia, incapacitation,etc.), passenger condition (e.g., medical condition; behavior; comfort;enjoyment, such as for a sightseeing flight; etc.), and/or any othersuitable human-related issues.

Aircraft equipment issues can include: structural issues (e.g., loose ormissing fasteners, undesired structural deflection or deformation,undesired vibrations, fatigued structural members, etc.); engine and/orpropulsion issues (e.g., indicated by sounds; temperatures such as oiltemperatures, cylinder temperatures, exhaust temperatures, bodytemperatures, etc.; oil pressures; fuel system data such as fuel flowand/or remaining fuel quantity; etc.); control issues (e.g., associatedwith flight control surface response, propulsion system response,landing gear actuation, etc.); electrical issues (e.g., battery issues,such as issues indicated by battery temperature, current, and/orvoltage; unpowered and/or inadequately powered components; circuitinterruptions, such as due to fuses or circuit breakers in a ‘tripped’or off state, due to severed or otherwise failed wiring, etc.; issuesindicated by characteristic odors; etc.); fires; environmental controlissues (e.g., cabin temperature, environmental air pressure and/oroxygen content, etc.); communication equipment issues such as radiofailure or other malfunction; and/or any other suitable aircraftequipment issues.

However, the issues determined in S330 can additionally or alternativelyinclude any other suitable issues, and/or S330 can additionally oralternatively include determining aircraft conditions in any othersuitable manner.

4.4 Acting Based on Aircraft Conditions.

Acting based on the aircraft conditions S340 preferably functions totake corrective action in response to potential issues and/or tomaintain desired aircraft operation. S340 is preferably performed inresponse to performing S330 (e.g., performed immediately in response todetermining that the current aircraft conditions are undesired, such asin near-real time), but can additionally or alternatively be performedat any other suitable time. S340 can optionally include controllingaircraft operation and/or reacting to undesired flight conditions (e.g.,as described below, such as regarding S450 and/or S640) and/or acting inany other suitable manner.

S340 preferably includes determining actions to take based on theseverity of the potential issues. For example, S340 can includedetermining actions to take (e.g., selecting from a set of potentialactions, types of actions, and/or desired outcomes) based on severityassessments (e.g., scores, rankings, etc.; determined in S330 orotherwise determined), such as ensuring that the aircraft avoidshigh-risk situations such as terrain or traffic collisions, rather thanprioritizing fuel savings or bird collision avoidance.

In a first embodiment, S340 includes controlling the aircraft (e.g.,altering aircraft operation) based on the aircraft conditions. Theaircraft can be controlled as described in U.S. application Ser. No.15/643,205, titled “Vehicle System and Method for Providing Services”,which is herein incorporated in its entirety by this reference. Forexample, S340 can include updating an aircraft mission plan (e.g., atthe aircraft flight management system), revising a planned series ofmaneuvers (e.g., at the guidance layer), and/or altering aircraftcontrol signals (e.g., at the control system). However, the aircraft canadditionally or alternatively be controlled in any other suitablemanner.

In this embodiment, S340 can include directly controlling aircraftcomponents and/or providing higher-level aircraft control guidance, andcan additionally or alternatively include controlling the aircraft inany other suitable manner. Directly controlling aircraft components caninclude, for example, altering (e.g., correcting) flight controls suchas control surface positions and/or propulsion system settings (e.g.,increase or decrease throttle), switching operation between aircraftcomponents (e.g., switching from a primary component to a backupcomponent), activating safety systems (e.g., retro-rocket and/orballistic parachute, such as described herein, such as regarding thesystem and/or contingency planning), and/or controlling any othersuitable components in any suitable manner. Providing higher-levelguidance can include, for example, altering the planned aircraft route(e.g., providing new tracks and/or waypoints to an aircraft autopilotsystem), commanding the aircraft to land (e.g., perform an emergencylanding; reroute to a dedicated landing site, such as the closest siteor the site that can be reached at the lowest risk; etc.), updating theaircraft decision-making algorithms, and/or providing any other suitableguidance. In some examples, S340 includes reacting to undesired flightconditions (e.g., as described below regarding S540), such as byimplementing a contingency plan (e.g., controlling the aircraft based onpredetermined guidance and/or control instructions) in response todetermining aircraft conditions (e.g., detecting undesired flightconditions, such as described below regarding S630), preferablyimmediately in response to determining the aircraft conditions (e.g., innear-real time), but alternatively after a predetermined delay (e.g.,associated with the contingency plan) and/or at any suitable time. S340can additionally or alternatively include determining and/orimplementing (e.g., controlling the aircraft based on) one or moremodified flight plans (e.g., different than a flight plan in use priorto determining the aircraft conditions S330), such as selecting, flyingto, and/or landing at a new aircraft destination, and/or aborting orchanging a mission associated with the aircraft. S340 can additionallyor alternatively include controlling the aircraft in an alternate state(e.g., as described below, such as regarding the embodiment 4 of themethod), such as changing aircraft operation from a normal flight modeto a conservative mode (e.g., wherein operation limits, such as speed,force, stress, safety margin, etc. are more conservative than in thenormal flight mode). For example, aircraft operation in the normalflight mode can include flying substantially at a first speed, whereasoperation in the conservative mode can include maintaining speed at orbelow a second speed less than the first speed (e.g., less by a factorsuch as 5%, 10%, 15%, 20%, 25%, 35%, etc.).

This embodiment can optionally include communicating the presence of theissue and/or the corrective actions taken in response to the issue(and/or any other suitable information). This information can becommunicated to a remote control entity (e.g., ground station network);an onboard or remote pilot, operator, and/or passenger; a controlauthority such as ATC; other aircraft (e.g., nearby aircraft); and/orany other suitable entities.

In a second embodiment, S340 includes presenting information associatedwith the aircraft conditions to one or more humans (e.g., pilot,passenger, remote operator, etc.). For example, S340 can includegenerating an alert output (e.g., auditory output such as a klaxon,‘ding’, and/or spoken alert; visual output such as a flashing alarm,indicator light, and/or display screen message; tactile output such as astick shaker; etc.) in response to determining the existence of apotential issue, which may prompt the operator to take correctiveaction. The alert output can be indicative of the aircraft conditions(e.g., “altitude below flight plan” or “altitude is 3200 feet”) and/orthe suggested corrective actions (e.g., “pull up” or “climb and maintain5000 feet”), but can additionally or alternatively be indicative of anyother suitable information. One variation of this embodiment includes,in response to detecting an undesired aircraft condition: determining aset of corrective actions (e.g., to correct the undesired condition);presenting an alert to an operator, informing the operator of theundesired condition and/or the corrective actions; receivingconfirmation (e.g., approval of the corrective actions, absence ofdenial of the corrective actions for a threshold period of time, etc.)from the operator; and, in response to receiving the confirmation,controlling the aircraft according to the corrective actions.

S340 can optionally include determining and/or adjusting the actionstaken based on information associated with the human pilot or operator.Such information can include: pilot skill level (e.g., input by theoperator or another human, determined based on historical flight dataand/or control performance, etc.), correlations with other pilots (e.g.,in similar flight conditions, on similar missions, operating the same orsimilar aircraft, etc.), preferences and/or policies (e.g., pilot alertsettings, company policy, etc.), training programs (e.g., a traineepilot is expected to be able to correct for, or is learning how tocorrect for, a first set of issues but not a second set of issues),and/or any other suitable pilot information. Adjustments to the actionstaken can include: changing between controlling the aircraft andpresenting information (e.g., switching from the first embodimentdescribed above to the second), altering one or more thresholds forperforming the actions (e.g., threshold severity, threshold duration ofundesired conditions, etc.), altering one or more intensities associatedwith the actions (e.g., changing to a different type of alert output,such as from a visual indicator to a klaxon, and/or introducingadditional alert outputs; changing the intensity of an alert output,such as increasing the volume of an audible alert; altering the typeand/or extremity of flight control adjustments; etc.), and/or any othersuitable adjustments.

In one variation, in which a trainee pilot is operating the aircraft,S340 can include acting immediately (e.g., not altering the performanceof S340 based on pilot information, reducing a threshold to act based onthe information, etc.) in response to detecting higher-severity issuessuch as issues that pose a significant safety risk. In this variation,in response to detecting lower-severity issues (e.g., slightlyuncoordinated flight during a turn), S340 can include: before taking anyaction, waiting for the trainee pilot to notice the issue and correct itwithout assistance, and only after a threshold time without pilotcorrection, generating a low-urgency alert output (e.g., visualindication, such as an “uncoordinated turn” message on a display) andthen continuing to wait. After a second threshold time followingpresentation of the low-urgency alert output in which the pilot stilldoes not correct the issue (e.g., does not attempt to correct the issue,fails to adequately correct the issue, etc.), S340 can include one ormore of: increasing the alert output urgency (e.g., generating a morenoticeable and/or higher-intensity alert), providing specificinstructions (e.g., “apply right pedal”), and/or controlling theaircraft to correct the issue (e.g., activating an autopilot module tocorrect the issue). However, the actions taken in S340 can additionallyor alternatively be determined based on any other suitable information.

During and/or after performing S340, the method preferably includescontinuing to perform S310 and/or S330, and continuing to perform S340(e.g., in response to new and/or updated determination of aircraftconditions, such as based on new inputs). For example, if S340 isperformed in response to determination of a potential issue, the methodcan include determining whether the potential issue has been resolved,and continuing to take action (e.g., the same actions as before and/ordifferent actions) or ceasing the actions based on the determination(e.g., if the issue has been resolved, ceasing the corrective actionsand returning to normal operation, such as by returning to flying theaircraft in a normal flight mode); if the corrective actions arebeginning to resolve the issue, continuing to perform them; if thecorrective actions are ineffective, performing additional or alternativecorrective actions).

S340 can additionally or alternatively include taking delayed actions(e.g., not immediately following S330), such as, after the completion ofa flight during which aircraft conditions are determined, taking actionsin response to the in-flight aircraft conditions. For example, S340 caninclude flagging aircraft conditions for actions such as investigationand/or repair, and then performing the actions at a time when they arepossible, easier, or otherwise preferred (e.g., performing aircraftmaintenance after landing, such as during a post-flight inspection,rather than during flight).

However, S340 can additionally or alternatively include performing anyother suitable actions in any other suitable manner.

4.5 Collecting Additional Information.

Collecting additional information S350 can function to enable refinementof determinations made in S320 and/or S330 (e.g., related to currentand/or future aircraft conditions). S350 can be particularly useful withregard to unfamiliar conditions, but can additionally or alternativelybe employed with regard to any suitable aircraft conditions. Forexample, in response to determining that the aircraft conditions areunfamiliar, the method can include collecting additional informationS350 to help determine the cause and/or effects of the unfamiliarconditions. However, S350 can additionally or alternatively includecollecting additional information regarding any suitable aircraftconditions, such as receiving confirmation (and/or disconfirmation) ofan aircraft conditions determination made in S330 (e.g., when theconditions are not unfamiliar). The additional information can includemechanical and/or structural information (e.g., a particular bolt isloose, a particular surface shows signs of mechanical fatigue, etc.),occupant-related information (e.g., passenger acting erratically,patient medical condition, etc.), sensory information (e.g., presence orabsence of a characteristic odor), and/or any other suitableinformation.

S350 can be performed in response to determining aircraft conditionsS330 (e.g., immediately in response, concurrent with S340, etc.),performed at times when the additional information can be safely and/oreasily collected, and/or performed at any other suitable time. In afirst variation, S350 is performed while the aircraft conditionsindicate presence and/or risk of a potential issue (e.g., as describedabove regarding requesting information from aircraft occupants in S310),such as during flight in response to determining the conditions in S330.In a second variation, S350 is performed after resolution of thepotential issue (e.g., immediately following its resolution, such as toavoid unnecessary crew distractions during a potentially dangerousperiod of time; after landing, such as during a post-flight inspection;etc.).

The method preferably includes performing (e.g., repeating) S320 basedon the additional information collected in S350 (e.g., update thetraining of the neural network generated in S320). For example, theinput correlations determined in S320 can be updated based on thedetermined cause of the inputs. The information determined in S350 canadditionally or alternatively be used directly, such as in S330 and/orS340 (e.g., aircraft conditions determined based on the additionalinformation, rather than or in addition to being determined based on theinput correlations), and/or can be used in any other suitable manner.

4.6 Example.

In one example (e.g., as shown in FIG. 3), aircraft attitude and/orcourse data sampled in S310 indicates that the aircraft is not followingcommanded instructions (e.g., control instructions received from a humanpilot or an autopilot module), such as a set of flight data indicativeof an undesired aircraft trajectory (e.g., aircraft not tracking along acommanded turn), and data from a control surface position sensor (e.g.,external sensor, such as camera, time-of-flight sensor such as lidar orradar, etc.; internal sensor, such as control surface and/or actuatorencoder, etc.) indicates that a control surface is not in the expected(e.g., commanded) position (e.g., due to rigging), such as beingindicative of an actuation failure of the flight control surface. Basedon the incorrect aircraft flight response and the improper controlsurface position, S330 includes determining the presence of an issuewith the control surface. To collect additional information S350 relatedto the control surface issue, a different control surface position iscommanded. The different control surface position can be farther alongthe current direction, toward a center or neutral position or anopposite extremum (e.g., followed by a return to the previous ororiginally-commanded position), or any other suitable position.

The result of the attempt to move the control surface (e.g., determinedbased on inputs such as attitude information, location information,external sensor measurements, etc.) is examined. In some cases (e.g.,wherein the issue is resolved or partially resolved by the controlsurface movement), the issue may be determined to have been caused by amiscalibration between the control surface commands (e.g., controlsignals sent to control surface actuators) and the actual resultingcontrol surface position. In these cases, the method preferably includestaking corrective actions such as adjusting the calibration (e.g.,recalibrating during flight and/or after landing), and it may bepossible to continue aircraft flight as usual (e.g., when the issue issufficiently resolved, such that it does not significantly hamper flightsafety and/or mission performance).

In other cases, there may be an inability to control (or fully control)the control surface (e.g., wherein control surface movement, such asmovement in one or more directions and/or into one or more normaloperating ranges, cannot be achieved or adequately and/or reliablycontrolled, possibly causing a directional bias during aircraft flight).In response to such an inability, the method preferably includesevaluating the aircraft conditions in light of the inability anddetermining appropriate corrective actions (e.g., based on thedirectional bias). The corrective actions can include: compensating forthe altered control surface movement (e.g., adjusting use of the othercontrol surfaces accordingly), restricting aircraft operation parameters(e.g., lower speed, wider turns, greater clearances from obstacles,etc.), rerouting (e.g., to reduce the magnitude and/or probability ofoperational challenges during flight), performing an expedited landing(e.g., at the nearest dedicated landing location or the dedicatedlanding location the aircraft can reach most easily or at the lowestrisk) or an emergency landing (e.g., in a non-standard landing location,such as the nearest or most easily reached acceptable landing location),deploying one or more safety systems (e.g., retro-rockets, ballisticparachutes, etc.), and/or any other suitable corrective actions.

The issue is preferably noted and/or communicated to other entities(e.g., ground station network), and can prompt further investigationand/or repair (e.g., the issue is ‘flagged’ for further attention duringpost-flight inspection and/or maintenance).

However, the method can additionally or alternatively include any othersuitable elements performed in any suitable manner.

5. Vehicle Control. 5.1 Sampling Inputs.

Sampling inputs S410 preferably functions to collect information thatcan inform aircraft operation (e.g., flight control). The inputs can besampled as described above regarding S310 and/or in any other suitablemanner. The inputs can be sampled together for both the method 3 forsituational awareness and the method 4 for vehicle control, sampledindependently for each method, and/or sampled with any other suitabletiming and/or number of samplings.

5.2 Determining Expected Input Characteristics.

Determining expected input characteristics S420 preferably functions toestablish expectations for sampled inputs. The characteristics caninclude expected (and/or unexpected) correlations (e.g., sensor-sensorcorrelations, sensor-control input correlations, control input-controlinput correlations, sensor-transmitted information correlations, etc.),expected (and/or unexpected) temporal trends (e.g., smooth samples,maximum rates of change, noise thresholds, etc.), and/or expected(and/or unexpected) input values (e.g., typical/atypical, usual/unusual,and/or possible/impossible values; values indicative/non-indicative ofinput failure; etc.). For human control inputs, the characteristics caninclude input quality classifications (e.g., including human-likemicroadjustments vs. substantially static), input agreement (e.g.,expected agreement and/or lack of conflict between human co-pilot and/ornon-human co-pilot control inputs), expected results of commandedbehavior (e.g., determining whether the control inputs correspond tosafe actions, such as based on current conditions), emotional stateclassification (e.g., based on the inputs, based on supplementary inputssuch as facial image emotion recognition, vocal emotion recognition,biosensor readings such as heart rate and/or blood pressure, etc.) suchas calm or panicked, and/or any other suitable characteristics.

The characteristics can be determined based on sampled inputs (e.g.,sampled during S410, previously sampled, etc.), simulated data (e.g.,finite element modeling results, such as for expected mechanical strainunder specified flight conditions), historical data (e.g., from the sameaircraft, same and/or similar aircraft types, and/or any suitableaircraft or other data sources), and/or any other suitable information.

The characteristics can be determined concurrent with and/or following(e.g., immediately, after a delay time, etc.) sampling the inputs S410,prior to sampling the inputs S410 (e.g., determined based on historicaldata concurrent with and/or following sampling of the historical data),and/or with any other suitable timing.

The characteristics can be represented (e.g., for storage, transmission,processing, etc.) as heuristics (e.g., identical sensors sampledconcurrently should yield similar measurements), functions (e.g.,correlating two or more input values over a functional form such as asurface), probability distributions, Bayesian networks, Markov chainsand/or control policies, convolutional neural networks, and/or can haveany other suitable representation. The characteristics can be determinedusing machine learning and/or statistical techniques (e.g., regression,classification such as valid or invalid, etc.), determined based onhuman inputs (e.g., human-defined heuristics, threshold values, and/orcorrelations, etc.), and/or determined in any other suitable manner.

The characteristics can be determined on-board (e.g., by an on-boardprocessor, such as a processor used to sample inputs S410, a differentprocessor, etc.), remotely (e.g., by a remote processor), and/or by anyother suitable components. Determining the characteristics S420 canadditionally or alternatively include receiving the characteristics(e.g., at the aircraft, from a remote server such as at a groundstation). The received characteristics can be determined (e.g., asdescribed above and/or otherwise), preferably by the transmitter (e.g.,the ground station), substantially concurrent with transmission (e.g.,immediately before transmission), prior to transmission (e.g., based onhistorical data), and/or with any other suitable timing.

In a first example, strain gauge readings (e.g., representing conditionssuch as vibrations and/or static strains indicative of aircraft statessuch as velocity and/or acceleration) can be correlated with readingssampled from IMUs, GPS receivers, radar systems (e.g., on-board radar,remote radar such as ATC radar, etc.), microphones (e.g., indicative ofvibrations, airflow with respect to the aircraft frame, etc.), and/orvisual sensors such as cameras (preferably analyzed using automatedimage analysis, but additionally or alternatively analyzed by humanoperators). In a second example, radar system (e.g., on-board radar)readings (e.g., indicative of a nearby obstacle) can be correlated withcamera inputs, ADS-B information, and/or information received fromdirect aircraft-aircraft communication (e.g., corroborating presence andposition of the obstacle). In a third example, sensor readings can becorrelated with pilot inputs, such as detection of the aircraft pitchapproaching a critical angle of attack (e.g., approaching a stallcondition) being correlated with a pilot input (e.g., yoke or stickforward adjustment) to reduce aircraft pitch. However, determiningexpected input characteristics S420 can additionally or alternativelyinclude determining any other suitable characteristics.

5.3 Determining Input Reliability.

Determining input reliability S430 preferably functions to assess thequality of the sampled inputs. Input reliability can be determined basedon the inputs (e.g., sampled in S410), the expected inputcharacteristics (e.g., determined in S420), and/or previous inputreliability determinations (e.g., determined in previous performances ofS430). The input reliability is preferably determined in response todetermining (and/or receiving) the inputs and/or expected inputcharacteristics (e.g., concurrent with sampling the inputs).

The input reliability can be determined continuously, periodically,sporadically, in response to occurrence of a trigger (e.g., extremevalue, other input determined to be unreliable, receiving a human inputtrigger, etc.), and/or with any other suitable timing. Each reliabilitydetermination can be applied for a single input (e.g., a single sensorreading), for a stream of inputs (e.g., sampled over time from a singlesensor), and/or for multiple input streams. The reliabilitydetermination can be sustained (e.g., for an input stream) until thenext reliability determination for that input stream is performed, for afixed time interval, until reset (e.g., in response to a human operatorreset input), and/or for any other suitable period of time.

Input reliability is preferably determined on-board the aircraft (e.g.,by one or more on-board processors, such as the processors that performS420 and/or different processors), but can additionally or alternativelybe performed remotely (e.g., by a remote processing system, wherein thedeterminations are subsequently transmitted to the aircraft).

Input reliability can be determined using machine learning and/orstatistical techniques (e.g., as described above regarding S420),heuristic techniques, based on human inputs (e.g., operator assessmentsof input reliability), and/or in any other suitable manner. PerformingS430 can produce one or more: classifications (e.g.,reliable/unreliable), confidence values (e.g., likelihood that the inputis reliable, such as determined by a regression technique), rankings(e.g., reliability-ordered list of input sources), and/or any othersuitable reliability information.

S430 can additionally or alternatively include determining adjustedvalues associated with one or more inputs. In a first example,less-reliable inputs are corrected based on more reliable inputs. In asecond example, derived values are determined based on multiple inputs,preferably reliable inputs, such as by averaging the input values (e.g.,average of only reliable inputs, weighted average based on confidencevalues, etc.). S430 can additionally or alternatively includedetermining derived values by performing analysis (e.g., based on theinputs such as reliable inputs, input correlations, etc.) such assimultaneous localization and mapping, wherein the results of theanalysis can be used for aircraft operation (e.g., used in determininginput reliability S430, determining guidance S440, etc.). For example,radar, camera, and IMU data can be used to determine aircraft location(e.g., if a GPS system is unreliable). However, S430 can additionally oralternatively produce any other suitable information, and/or include anyother suitable elements.

In a first variant, in which input reliability is determined based on avoting process, the aircraft includes three identical sensors (e.g.,rotor head rotational speed sensors), each of which samples an inputstream (e.g., received at the same processor, at three independentprocessors, etc.). Two of the sensors produce similar input values(e.g., near 1000 RPM, such as within 1%, 2%, or 5%) and the third sensorproduces a very different input value from the other two (e.g., zero orsubstantially zero). The two mutually-consistent sensors are determinedto produce reliable inputs, and the third (inconsistent) sensor isdetermined to produce unreliable inputs (e.g., determined at the sameprocessor that samples the inputs, at a different processor, etc.). Thetwo reliable input values can be averaged (e.g., at the same processorthat determines their reliability, the same processor that samples them,a different processor, etc.) to produce a derived value.

In a second variant, inputs (e.g., received at the same processor, atmultiple independent processors, etc.) are sampled from a plurality ofdifferent sensors. A first sensor (e.g., rotor head rotational speedsensor) produces readings inconsistent with the other sensors (e.g., thefirst sensor indicates zero rotor head rotation, but other inputs areindicative of vibrations consistent with normal engine operation androtor head rotation). Based on the inconsistent readings, the firstsensor is determined to be unreliable. The inconsistency can bedetermined based on classification (e.g., inputs from IMUs and straingauges are each classified as “engine on & rotor head spinning normally”inputs, and the first sensor input is classified as a “rotor headstopped” input), regression (e.g., first sensor input value is faroutside the rotational speed predicted based on other inputs such asIMUs and/or strain gauges, from single-variable and/or multivariateregressions against the other inputs), and/or any other techniques. Theunreliable input value from the first sensor can optionally be replacedby a derived value (e.g., predicted rotor head rotational speed, basedon the regression against the IMU and strain gauge inputs).

In a third variant, a time series of readings from a sensor (e.g., inputstream) indicates unreliability of the input stream (and/or a subset ofthe values, such as a specific time interval). The unreliability can bedetermined based on rapidly changing input values, frequent step changes(e.g., erratic readings), and/or any other suitable indications.

In a fourth variant, an input is determined to be unreliable because theinput value is unlikely or impossible. For example, if a sensor normallyproduces an electrical signal between 0.2 V and 1 V to represent itscurrent reading, and the sensor is currently producing a 1.2 V signal,the input associated with the sensor can be determined to be unreliable.The input value can optionally be replaced by a derived value (e.g., 1V, representing a full-scale reading).

In a fifth variant, a pilot control input is determined to beunreliable. In a first example, the input is determined to be unreliableif the system determines that the behavior commanded by the controlinput may (e.g., will, is likely to, could possibly) cause anundesirable result (e.g., obstacle collision, breach of safety thresholddistance from obstacle, breach of mechanical stress threshold,non-compliance with ATC instructions, aircraft stall, etc.). In a secondexample, the input is determined to be unreliable if the systemdetermines that the control input is potentially spurious (e.g., extremestatic input). In a third example, the input is determined to beunreliable if the system determines that the pilot's decision-makingabilities may be compromised (e.g., erratic inputs; indications of panicsuch as biosensor readings, facial expression recognition, vocal emotionrecognition, etc.; opposing and/or otherwise incompatible inputs fromco-pilots; low cabin air pressure and/or other indications of hypoxia;etc.). This variant can optionally include generating an alert output(e.g., auditory output such as a klaxon and/or spoken alert, visualoutput such as a flashing light, tactile output such as a stick shaker,etc.) in response to determining the pilot control input is unreliable,which may prompt the pilot to correct the input.

S430 can optionally include assessing input reliability based on theresulting guidance (e.g., guidance determined based on the inputs, suchas described below regarding S440). The reliability of a subset ofinputs can be assessed based on guidance determined based on the subset(e.g., based only on the subset, based on the subset and additionalinputs, etc.). For example, the reliability of a subset of inputs can beassessed by comparing guidance determined based on all availableinformation with guidance determined based on all available informationexcept the subset.

S430 can additionally or alternatively include assessing computationalmodule (e.g., processor) reliability. For example, in a system in whichdifferent inputs are received and/or processed at independentprocessors, S430 can include determining that one or more of theprocessors is unreliable (e.g., based on determining that one or moreinputs associated with the processors are unreliable, such as describedabove). In response to determining that a processor is unreliable, S430can optionally include: considering any or all inputs associated withthe unreliable processor to be unreliable inputs, reassigningcomputational responsibilities (e.g., receiving and/or processing inputsusing an alternate, reliable processor), and/or compensating forprocessor unreliability in any other suitable manner. In a specificexample, in which a single sensor sends measurements to multipleindependent processors (e.g., resulting in multiple inputs that areexpected to be identical), S430 can include determining that one or moreof the processors is unreliable (e.g., based on discrepancies betweenthe different inputs associated with the sensor, discrepancies betweeninputs from the sensor and other inputs, etc.; such as described aboveregarding input unreliability). However, the method can additionally oralternatively include determining and/or compensating for computationalfailure and/or unreliability in any other suitable manner.

However, determining input reliability S430 can additionally oralternatively include any other suitable elements.

5.4 Determining Guidance.

Determining guidance S440 preferably functions to determine controlinstructions for aircraft operation. Guidance is preferably determinedin response to determining and/or receiving the inputs and/orreliability determinations. Guidance is preferably determinedcontinuously, but can alternatively be determined periodically,sporadically, in response to trigger occurrence (e.g., receiving anoperator request to generate guidance, detecting a significant change inflight conditions, etc.), and/or with any other suitable timing. Theguidance is preferably determined by one or more on-board processors(e.g., different than or the same as the processors used in otherelements of the method), but can additionally or alternatively bedetermined by a remote processing system and/or any other suitablesystem.

The guidance can be determined based on the sampled inputs (preferablyexcluding unreliable inputs), derived values, and/or reliabilitydeterminations. In one embodiment, the guidance is determined basedfurther on control policies (e.g., mission plan and/or other controlpolicies, such as described in U.S. application Ser. No. 15/643,205,titled “Vehicle System and Method for Providing Services”, which isherein incorporated in its entirety by this reference), such as neuralnetworks and/or Markov control policies.

Determining the guidance S440 can include determining potential issues(e.g., risks such as collisions, low fuel conditions, equipment failure;optimization considerations such as route, speed, efficiency; etc.),scoring or ranking the potential issues (e.g., categorizing the issuesand ranking them based on predetermined category rankings, scoring basedon predicted negative and/or positive impacts, etc.), and determiningguidance based on the scoring or ranking (e.g., ensuring that theaircraft avoids high-risk situations such as terrain collisions, ratherthan prioritizing fuel savings or bird collision avoidance).

In some variants, determining the guidance S440 is based (in part) onaircraft inspection and/or historical information. For example,determining the guidance can include determining operational guidelines(e.g., safety thresholds) based on the inspection and historicalinformation (e.g., restricting operation to a more conservative set ofconditions for an aircraft that is older and/or more likely to undergofailures, while allowing operation under less conservative conditionsfor an aircraft that is newer and/or less likely to undergo failures;entering an alternate state, such as described below, based on theinformation; etc.).

Determining guidance S440 preferably includes determining (e.g.,independently, such as at different independent processors) a pluralityof preliminary guidances S441 and determining master guidance based onthe preliminary guidances S442 (e.g., multiplexing the preliminaryguidances to generated the master guidance). Each preliminary guidanceis preferably determined by a different processor (e.g., dedicatedprocessor) or processor portion, but the preliminary guidances canadditionally or alternatively be determined by the same processor orprocessors. The master guidance is preferably determined by one or moremultiplexers (e.g., processor, multiplexer circuit, mechanicalmultiplexer, etc.) different from the other processors, but canadditionally or alternatively be determined using the same processor(s)as used for determining the preliminary guidances S441.

In a first embodiment, S441 includes determining each preliminaryguidance based on the same (or substantially the same) set ofinformation (e.g., based on all available inputs and reliabilitydeterminations, based on a subset of the available information, etc.).In a first example of this embodiment, each preliminary guidance can bedetermined using a different algorithm (e.g., autopilot algorithms), bythe same processor, different processors, and/or any other suitableprocessors. In a second example, each preliminary guidance can bedetermined using the same algorithm, implemented on independentprocessors and/or other hardware. In this embodiment, the resultingpreliminary guidances can possibly be identical or similar, but one ormore can alternatively be substantially different (e.g., potentiallyindicative of a failure in the algorithm and/or hardware responsible forgenerating the differing guidance). In this embodiment, the masterguidance can be generated by combining (e.g., averaging) all or a subsetof the preliminary guidances (e.g., subset including only the similarpreliminary guidances), selecting one of the preliminary guidances,and/or multiplexing the preliminary guidances in any other suitablemanner. Selecting one preliminary guidance can include: for identicalalgorithms, selecting one of the identical preliminary guidances (e.g.,based on a voting scheme); for different algorithms, selecting based onan algorithm score or ranking, such as a predetermined ranking or ascore determined based on the inputs, input reliabilities, and/orresulting preliminary guidances (e.g., during high-risk situations, suchas potentially imminent terrain collisions, prioritizing algorithms thatdo not consider lower-risk considerations, such as bird collisions);and/or selecting based on any other suitable criteria.

In a second embodiment, S441 includes determining each preliminaryguidance based on a different subset of the available information (e.g.,based on different inputs and/or types of inputs). For example,different guidances can be determined based on mutually-exclusivesubsets of the information, based on partially-overlapping subsets,based on subsets that contain and/or are contained by other subsets(e.g., two subsets, including and excluding one type of input such aspilot control inputs, respectively), and/or based on any other suitableinformation.

Determining guidance S440 can optionally include determining one or moreguidances (e.g., preliminary guidances, master guidance, etc.) based onhistorical information, such as recorded behavior of aircraft (e.g.,operated by human pilots) under various circumstances (e.g., similar tocurrent aircraft circumstances). For example, the method can optionallyinclude: recording information (e.g., inputs such as described aboveregarding S410) during human-piloted aircraft operation (e.g., duringtypical aircraft operation; during real and/or simulated adverseconditions, such as sensor failures, flight control system failures,adverse weather, imminent terrain and/or vehicle collisions, etc.),and/or training guidance-determination algorithms (e.g., using machinelearning techniques such as convolutional neural nets) based on therecorded information.

Determining guidance S440 can optionally include determining desiredflight control behavior (e.g., based on human control inputs, autonomouscontrol guidances, etc.) and/or determining guidance based on thedesired behavior.

Determining guidance S440 can optionally be based on which inputs areunreliable (and/or the extents of their unreliability, such asconfidence metrics, duration of unreliability, etc.). For example, theguidance can correspond to controlling the aircraft in an alternatestate (e.g., flying the aircraft in an alternate mode, rather than in anormal flight mode) in response to determining that inputs (e.g., anyinputs, specific mission-critical and/or desired backup inputs, such asthe primary sensor inputs, numerous inputs such as a number of inputsexceeding a safety threshold, etc.) are unreliable. The alternatestate(s) can include, for example, an emergency state, danger state,conservative operation state, reduced function state, and/or any othersuitable alternate operation states. In specific examples, in thealternate state(s), the guidance can correspond to controlling theaircraft to fly more conservatively, to abort its current mission andproceed to a landing area, to perform an emergency landing, to deployemergency safety systems, and/or to operate in any other suitablemanner. Additionally or alternatively, human pilot input (e.g., on-boardpilot, remote pilot) can be requested and/or required (e.g., whereinother conservative actions, such as emergency landing and/or safetysystem deployment, are performed if human pilot input is not received).

For example, S440 can include, in response to determining that the pilotcontrol input is unreliable: ignoring the input (e.g., not determiningpilot control-based guidance, not basing master guidance determinationon the pilot control-based guidance, etc.) and instead determiningguidance based on a set of inputs excluding the pilot control input(e.g., sensor-based guidance); or determining modified guidance based onthe pilot control input (e.g., informed by the commanded behavior butnot violating safety concerns). For example, if a pilot control inputcorresponds to an extreme left bank that could exceed mechanical strainthresholds and/or cause the aircraft to enter a spin, S440 can includedetermining guidance to perform a less extreme left bank (e.g., thatstays within the safety thresholds).

Determining guidance S440 can optionally include determining multiplelevels of guidance (e.g., wherein lower-level guidance is determinedbased on higher-level guidance, preferably along with additionalinformation such as input values). For example, S440 can includedetermining high-level guidance (e.g., destination, mission parameters,etc.), determining mid-level guidance (e.g., elevation, waypoints,maneuvers, such as for obstacle avoidance, etc.) based on the high-levelguidance, determining low-level guidance (e.g., heading, velocity,airspeed, etc.) based on the mid-level guidance, and determiningcontrol-level guidance (e.g., throttle settings, control surfacesettings, etc.) based on the low-level guidance.

For each level of guidance, multiple guidances of that level canoptionally be determined independently. Each guidance can be determinedbased on the same or different information, using the same or differenttechniques (e.g., algorithms), by the same or different hardware (e.g.,processors). For example, S440 can include independently determiningmultiple (e.g., four) different low-level guidances based on the samemid-level guidance, each using a different algorithm implemented on anindependent processor. Each guidance-determining algorithm preferablyaccepts identically-formed input information (e.g., the higher-levelguidance, the sensor inputs, etc.), but can additionally oralternatively accept differently-formatted information. Eachguidance-determining algorithm preferably generatesidentically-formatted output information (e.g., the guidance), but canadditionally or alternatively generate differently-formattedinformation. This can enable addition or substitution of differentalgorithms and/or hardware (e.g., processors, control hardware such asservos, etc.). S440 can optionally include developing newguidance-determining algorithms during flight (e.g., using machinelearning techniques to train a new algorithm, such as based on theperformance of the other algorithms).

Determining master guidance S442 can optionally include determiningguidance reliability (e.g., of preliminary guidance, master guidance,etc.), wherein higher-level guidance is preferably determined based onlyon reliable lower-level guidance. Guidance reliability can be determinedat the multiplexer, upstream of the multiplexer (e.g., only sendingreliable guidance to the multiplexer), and/or by any other suitableelements (e.g., processing elements). Guidance reliability can bedetermined analogously to input reliability (e.g., as described aboveregarding S430) and/or in any other suitable manner. In a first example,the method includes classifying the reliability of each preliminaryguidance (e.g., using machine learning and/or statistical analysistechniques, based on similarity to a known-reliable guidance, based onclustering, etc.). In a second example, S442 includes independentlydetermining multiple master guidances at three or more independentprocessors, based on identical preliminary guidance and using identicalalgorithms, and determining reliability based on voting process.

Determining guidance S440 (and/or any other suitable elements of themethod, such as determining input reliability S430) can optionally beperformed based on one or more safety corridors (e.g., as describedbelow). For example, guidance that violates a safety corridor and/orinput information indicating that it would be safe to violate a safetycorridor can be determined to be unreliable (and/or less reliable thanother guidances and/or inputs), preferably wherein alternate guidancesand/or inputs are used (e.g., instead of the unreliable guidances and/orinputs). One example includes: determining a safety corridor includingthe aircraft's location; sampling multiple sets of sensor data, each ata different sensor and/or set of sensors of the aircraft; determiningmultiple guidances (e.g., primary guidance, typically relied on foraircraft operation, and one or more auxiliary guidances, typically usedas supplements and/or redundancies to the primary guidance), each basedon a different set of sensor data (e.g., each determined at a separateprocessor, such as independent processors of the aircraft); determiningthat the primary guidance violates the safety corridor (e.g., isassociated with aircraft traversal to a first location outside thesafety corridor), preferably determining that the primary guidance(e.g., and the associated sensor, sensor data, and/or processor) isunreliable; determining that an auxiliary guidance does not violate thesafety corridor (e.g., is associated with aircraft traversal only tolocations within the safety corridor, such as to a second location); and(e.g., based on the determinations) autonomously controlling theaircraft based on the auxiliary guidance (e.g., including controllingthe aircraft to fly substantially to the second location) rather thanthe primary guidance.

However, the guidance can additionally or alternatively be determined inany other suitable manner.

5.5 Controlling Aircraft Operation.

Controlling aircraft operation S450 preferably functions to operate theaircraft (e.g., autonomously). The aircraft is preferably controlledcontinuously (e.g., throughout flight), and can be controlled inresponse to receiving guidance (e.g., determined in S440), preferablycontrol-level guidance but additionally or alternatively any othersuitable guidance. The aircraft is preferably controlled by one or moreon-board processors (e.g., the same as or different than the processorsused for other elements of the method), but can additionally oralternatively be controlled by a remote processing system and/or anyother suitable processing system. Additionally or alternatively, theaircraft can be controlled by a human operator (e.g., on-board pilot,remote operator, etc.), such as by operating mechanical and/orelectronic flight control inputs (e.g., as in typical aircraft flight).S450 can optionally include acting based on aircraft conditions and/orreacting to undesired flight conditions (e.g., as described herein, suchas regarding S340 and/or S640) and/or controlling aircraft operation inany other suitable manner.

Controlling aircraft operation S450 can include controlling propulsionmechanisms, flight control surfaces, communication modules, and/or anyother suitable aircraft elements, and can additionally or alternativelyinclude controlling remote equipment (e.g., elements apart from theaircraft). For example, S450 can include controlling flight controlsurface actuators to move the flight control surfaces (e.g., altercollective, cyclic, tail rotor collective, etc.), controlling the rotorengine throttle, and/or controlling a radio to broadcast the aircraftoperating conditions. The aircraft elements can optionally be controlledusing redundant actuators (e.g., redundant mechanical actuators). Forexample, the aircraft can include multiple independent (e.g.,dissimilar) mechanical systems configured to actuate a single flightcontrol surface.

Aircraft operation is preferably controlled based on guidance (e.g,determined in S440). For example, an autonomous control module cancontrol the aircraft flight surfaces based on the guidance, and/or ahuman operator can fly according to the guidance (e.g., presented to thehuman operator). The aircraft is preferably controlled using closed-loopcontrol systems (e.g., adjusting control outputs and/or guidancedeterminations iteratively based on inputs such as sensor readings), butcan additionally or alternatively be controlled using open-loop controlsystems and/or any other suitable control systems.

Additionally or alternatively, autonomous control can be overriddenbased on human inputs (e.g., pilot control inputs). For example,autonomous flight system guidance can be overridden based on receivingany pilot control input, receiving pilot control inputs that areincompatible with the autonomous guidance, receiving an override input(e.g., before receiving the override input, autonomous flight systemguidance can override human inputs such as described above, whereas inresponse to receiving the override input, human inputs can override theautonomous flight system guidance), and/or in response to any othersuitable trigger. However, controlling aircraft operation S450 canadditionally or alternatively include any other suitable elements.

5.6 Variants.

In a first variant of the method 4, each on-board sensor is classifiedas either a primary or secondary sensor. The method can include:sampling primary sensor inputs S410 from a set of primary sensors (e.g.,on-board radar sensors) at an on-board primary input processor;determining that the primary sensor inputs are reliable S430 (e.g., atthe primary input processor, at an on-board reliability processorconfigured to receive data from the primary input processor, etc.); anddetermining primary guidance based on the primary sensor inputs (e.g.,at the primary input processor).

In a first example of this variant, the method further includes failingto sample reliable inputs from the secondary sensors. For example, noinputs can be sampled from the secondary sensors, or inputs can besampled S410 (e.g., at an on-board secondary input processor) butdetermined to be unreliable S430 (e.g., at the secondary inputprocessor, reliability processor, a second reliability processor, etc.).In response to determining that the primary sensor inputs are reliableand the secondary sensor inputs are not, the method can includecontrolling the aircraft S450 based only on the primary guidance (e.g.,at a global control processor configured to receive data from both theprimary and secondary input processors, at a primary control processorconfigured to receive data from the primary input processors and notfrom the secondary input processor, etc.).

In a second example of this variant, the method includes samplingsecondary sensor inputs S410, determining that the secondary sensorinputs are reliable S430 (e.g., using the same processor(s) as describedabove regarding the first example), and determining secondary guidancebased on the secondary sensor inputs (e.g., at the secondary inputprocessor). In response to determining that all inputs are reliable, themethod can include generating master guidance based on the primary andsecondary guidance (e.g., at the global control processor, at amultiplexer, etc.) and controlling the aircraft S450 based on the masterguidance (e.g., at the global control processor).

In a second variant of the method, the sensor inputs and/or other inputsare used to supplement human operator situational awareness, and/or tooverride human operator control inputs. In this variant, the methodincludes: sampling sensor inputs S410 (e.g., at a sensor inputprocessor); determining that a sensor input is unreliable S430 (e.g.,based on incompatibilities between the unreliable input and other sensorinputs, based on a deviation from expected correlations such ascorrelations determined by S420 and received from the ground stationnetwork, etc.); determining sensor-based guidance based on the reliablesensor inputs; presenting the sensor inputs and/or sensor-based guidanceto a human operator (e.g., on-board pilot, remote pilot, passenger,etc.); and sampling control inputs S410 from the human operator (e.g.,after, concurrent with, and/or before presenting the sensor inputsand/or guidance to the human operator; at a human input processor). Thisvariant preferably includes presenting only reliable sensor inputs(e.g., excluding unreliable inputs), and can optionally includepresenting the reliability determination (e.g., informing the pilotwhich sensors are producing unreliable inputs).

In a first example of this variant, the method further includes:determining S430 that the control inputs are unreliable (e.g., asdescribed above regarding S430; at the human input processor); andcontrolling the aircraft S450 based on the sensor-based guidance (e.g.,ignoring the unreliable control inputs) at a control processor.

In a second example, the method further includes: determining S430 thatthe control inputs are reliable (e.g., as described above regardingS430; at the human input processor); determining control-based guidancebased on the control inputs; generating master guidance based on thesensor- and control-based guidance (e.g., at the control processor, at amultiplexer, etc.) and controlling the aircraft S450 based on the masterguidance (e.g., at the global control processor). However, the methodcan additionally or alternatively include any other suitable elements,performed in any other suitable manner, with any other suitable timing.

6. Contingency Planning. 6.1 Operating the Vehicle.

Operating the vehicle S610 is preferably performed under nominalconditions and/or according to a mission plan (e.g., predeterminedmission plan). The vehicle is preferably operated autonomously, but canadditionally or alternatively be operated by a human pilot, a remoteoperator, and/or any other suitable entity. S610 can include operatingthe vehicle before, during, and/or after flight, and/or any othersuitable vehicle operation.

The aircraft can be operated as described (e.g., regarding controllingaircraft flight and/or any other suitable elements) in U.S. applicationSer. No. 15/643,205, titled “Vehicle System and Method for ProvidingServices”, which is herein incorporated in its entirety by thisreference. For example, operating the aircraft can include determiningand/or updating an aircraft mission plan (e.g., by the aircraft flightmanagement system, such as by a mission planner module, etc.), revisinga planned series of maneuvers (e.g., by the guidance layer, such as by amission executor module), and/or altering aircraft control signals(e.g., by the control system, such as by an aircraft autopilot).However, the aircraft can additionally or alternatively be controlled inany other suitable manner.

6.2 Planning for Contingencies.

Planning for contingencies S620 can function to enhance situationalawareness and/or to enable rapid response to unexpected (e.g.,undesired) flight conditions. S620 is preferably performed throughoutvehicle operation (e.g., during aircraft flight, before and/or afterflight, etc.), and can additionally or alternatively be performed at anyother suitable time. For example, S620 can be performed continuously,periodically, sporadically, in response to triggers (e.g., receipt ofinformation, such as updated input information), and/or with any othersuitable timing. S620 is preferably performed on-board the aircraft(e.g., by one or more on-board processors), but can additionally oralternatively be determined remotely (e.g., by a remote processingsystem, such as based on inputs transmitted from the aircraft to theremote processing system, wherein the determinations are subsequentlytransmitted to the aircraft).

S620 preferably includes determining one or more reactions (e.g.,optimal and/or best-known reactions) to undesired flight conditions(e.g., off-nominal conditions, such as emergency conditions). Thereactions can include any suitable actions the aircraft is capable ofperforming (e.g., such as described below regarding S640). For example,the reactions can include controlling the aircraft to fly to and/or landat a target location, to deploy one or more safety systems, tocommunicate (e.g., with vehicle occupants, with external endpoints,etc.), and/or any other suitable reactions.

Determining the reactions preferably includes, for each undesired flightcondition to plan for, evaluating candidate reactions and selecting theoptimal reactions. Evaluating a reaction can include assessing factorsassociated with the reaction, such as determining probabilities ofpotential results, assessing consequences of the outcomes (e.g.,consequences of failure, such as morbidity and mortality, propertydamage, etc.), determining a metric (e.g., score, rank, classificationsuch as good or bad, etc.) associated with the reaction and/or predictedresult, and/or otherwise assessing the outcomes. In some variations,assessing a reaction includes combining metrics associated withpotential results (e.g., average of the metric for each potentialresult, weighted by the likelihood of that result occurring). Thereactions can be evaluated based on, for example: flight models (e.g.,models determined based on previous flight data, flight physics, etc.),machine learning techniques, heuristics, partially observable Markovdecision processes (POMDPs), and/or human (e.g., pilot, passenger,remote operator, etc.) inputs.

Undesired flight conditions can include equipment problems (e.g.,failures), unfavorable (e.g., extreme) weather, imminent and/or possiblecollisions, receipt of emergency inputs, and/or any other undesiredconditions. Equipment problems can include: power loss (e.g., enginefailure, electrical system failure, etc.), low fuel conditions, sensorfailures, structural problems (e.g., chassis damage), control failures(e.g., unresponsive flight control surfaces), communication modulefailures, and/or any other suitable problems with aircraft equipment. Inone example, an emergency input is received from a remote entity, suchas a remote operator, ground station, air traffic controller, and/orother (e.g., nearby) aircraft. In another example, an emergency input isreceived from an aircraft payload, such as an on-board human (e.g.,pilot, crew, passenger, etc.; request to land immediately, reroute toavoid collision, etc.) or cargo, such as from a sensor sampling cargocondition (e.g., sensor detecting a temperature increase that couldresult in damage to a temperature-sensitive payload). However, theemergency inputs can additionally or alternatively be received from anyother suitable entities.

The reactions are preferably determined and/or evaluated (and/orre-evaluated) based on the current aircraft and/or environmental status,such as based on information (e.g., data sources, such as data streams)sampled and/or received by the aircraft (e.g., as described aboveregarding S310 and/or S410) and/or determined (e.g., by aircraft stateestimators) based on the sampled and/or received information (e.g.,information regarding the aircraft state, the surrounding environment,the results and/or desirability of determined reactions, etc.; such asdescribed above regarding S330, S430, S440, S350, and/or S710, etc.).For example, reactions can be determined and/or evaluated based on anysuitable mission parameters and/or state data (e.g., as described inU.S. application Ser. No. 15/643,205, titled “Vehicle System and Methodfor Providing Services”, which is herein incorporated in its entirety bythis reference). The reactions can additionally or alternatively bedetermined and/or evaluated based on current and/or previous sensormeasurements (e.g., aerial vehicle sensors, terrestrial sensors, sensorsof other aircraft, etc.), human observations (e.g., aerial vehicleoccupant, such as pilots, crew, and/or passengers; occupants of otheraircraft; terrestrial observers; ground operators; air trafficcontrollers; etc.), and/or any other suitable data sources describedherein (e.g., determined as described elsewhere within this disclosure,such as regarding the embodiments 3 and/or 4 of the method, the method 7associated with the safety corridor, the data sources, etc.; exampleshown in FIG. 11), and/or based on any other suitable information.

S620 can optionally include determining uncertainty metrics associatedwith the determinations of vehicle state, environment state,consequences of the reactions, and/or the desirability of suchconsequences (e.g., uncertainty metrics based on and/or associated withPOMDPs), and/or can include gathering and/or requesting additionalinformation (e.g., in response to determining a high level ofuncertainty). In one example, S620 includes altering a sensorconfiguration or operation scheme to sample additional information(e.g., targeting a scanning sensor at a specific location for which thecurrent information is insufficient). In a second example, S620 includesasking a vehicle occupant to verify (and/or obtain) information, such asverifying the presence of an obstacle at a specific heading, verifyingthat a planned landing location is unoccupied and safe to land at,and/or verifying the integrity of one or more aircraft components (e.g.,verifying that the landing gear is retracted or extended). In a thirdexample, S620 includes asking a remote entity (e.g., dispatch center orground station, ATC, another aircraft, etc.) to verify, provide, and/orupdate information, such as weather information (e.g., currentconditions, forecasts, etc.), traffic conditions (e.g., air traffic,terrestrial traffic, etc.), and/or availability of emergency services(e.g., at a planned landing location). However, S620 can additionally oralternatively include obtaining any suitable information in any othersuitable manner.

In one example, (e.g., as shown in FIG. 10), the contingency managerdetermines one or more potential reactions, evaluates the optimalityand/or uncertainty associated with one or more of the potentialreactions, and selects a set of one or more acceptable reactions basedon the evaluation (e.g., selecting all reactions that exceed an minimumoptimality threshold and pass under a maximum uncertainty threshold).The potential reactions are preferably determined based on the currentaircraft and/or environmental status (e.g., as described above), but canadditionally or alternatively include predetermined reactions and/or anyother suitable reactions. Uncertainty associated with a reaction caninclude uncertainty associated with results of the reaction (e.g.,expected result of the reaction, a set of likely or possible results ofthe reaction), such as a probability that a result or one of a set ofresults will occur, and/or a difference (e.g., difference in resultingaircraft and/or environment state, difference in optimality score, etc.)between possible results (e.g., results within a threshold likelihood,such as within a 65%, 75%, 90%, 95%, or 99% confidence interval, etc.).Uncertainty associated with a reaction can additionally or alternativelyinclude uncertainty associated with the aircraft and/or environmentalstatus. Optimality associated with a reaction can include optimality ofthe expected result, the best- and/or worst-case result, the best-and/or worst-case result within a threshold likelihood (e.g., within aconfidence interval such as 65%, 75%, 90%, 95%, or 99%; result having alikelihood of occurrence greater than a threshold, such as 0.1%, 1%, 5%,10%, 20%, 30%, etc.), and/or optimality of any other suitable result.The optimality can include a score, a ranking, a classification (e.g.,optimal, acceptable, marginal, unacceptable, etc.), and/or any othersuitable indication of optimality. This example preferably includesselecting a desired reaction from the set of acceptable reactions (e.g.,based on the evaluation). In specific examples, the selected reaction isthe reaction with the greatest optimality, the reaction with the leastuncertainty, or the reaction minimizing a function of optimality anduncertainty (e.g., a function that increases with uncertainty anddecreases with optimality). This example can optionally includerequesting additional information (e.g., as described above), such asrequesting additional information associated with any reaction for whichthe uncertainty is greater than a threshold (e.g., maximum uncertaintythreshold described above; a second threshold, such as a threshold lessthan or greater than the maximum uncertainty threshold; etc.). However,the potential reactions can additionally or alternatively be determined,evaluated, and/or selected in any other suitable manner.

S620 can optionally include modifying aircraft operation based on thereaction determinations and/or assessments, such as altering operation(e.g., under nominal conditions) to improve the available reactions. Inexamples, modifying aircraft operation can include modifying the missionplan, altering planning factors (e.g., penalizing undesirable actionsand/or promoting desirable actions), suggesting and/or requestingoperation modification, and/or modifying aircraft operation in any othersuitable manner.

Determining reactions to aircraft power loss (e.g., in embodiments inwhich the aircraft includes one or more safety systems, such as anelectric motor powered by a battery and configured to drive a rotor ofthe aircraft, retrorockets, and/or any other suitable propulsionmechanisms) can include assessing aircraft state in relation to arotorcraft height-velocity curve (“dead-man's curve”), which canindicate safe and/or unsafe rotorcraft operation parameters relating toemergency landings. In one variation, the height-velocity curve is astandard height-velocity curve (e.g., determined by and/or for humanpilots) for the vehicle type. In a second variation, the height-velocitycurve accounts for the autonomously-controlled nature of the vehicle(e.g., not accounting for human pilot reaction time, such as a 1-secondreaction time above the knee of the curve) and/or the safety systems ofthe vehicle (e.g., factoring in the possible effects of the safetysystems, such as retrorockets, parachutes, backup powerplants, etc.). Inthe second variation, the height-velocity curve can be determinedindependently (e.g., by flight testing and/or modelling), determined bymodifying the standard height-velocity curve for the vehicle, and/ordetermined in any other suitable manner. However, the height-velocitycurve can additionally or alternatively include any other suitableinformation relating to emergency landing contingencies. The vehiclepreferably avoids operation within dangerous regions of the (modified)height-velocity curve (e.g., if the vehicle is operating in and/orplanning to enter such a dangerous region, preferably modifying vehicleoperation to avoid the dangerous region).

Assessing aircraft state in relation to the height-velocity curve caninclude determining actions to take immediately in response to aircraftpower loss, such as determining how to use the safety systems (e.g., howto escape a dangerous region of the height-velocity curve by usingsafety systems such as retrorockets and/or backup powerplants). Forexample, the actions can include causing the vehicle to gain altitude(e.g., at substantially constant airspeed, while increasing airspeed,while decreasing airspeed, etc.) and/or gain airspeed (e.g., atsubstantially constant altitude, while increasing altitude, whiledecreasing altitude, etc.), thereby preferably reaching a safe region(in height-velocity space) of the height-velocity curve (e.g., as shownin FIG. 8A). Once a safe region is attained, the aircraft can then beoperated to land safely (e.g., by controlling the aircraft duringautorotation to achieve safe descent to an acceptable landing location).The reactions can additionally or alternatively include performance ofautorotation maneuvers (e.g., immediately following power loss) withoutuse of the safety systems (e.g., in examples in which the aircraft doesnot require safety system use, such as during operation outside of thedead man's curve).

Determining reactions to aircraft power loss can additionally oralternatively include determining guidance and/or control instructionsfor deploying other aircraft safety systems (e.g., as described in U.S.application Ser. No. 15/904,082, titled “Safety System for AerialVehicles and Method of Operation”, which is herein incorporated in itsentirety by this reference), such as parachutes. In one example (e.g.,in which the aircraft includes an airframe, a rotor rotationally coupledto the airframe about a rotor axis, and/or a parachute mechanicallycoupled to the airframe), the reactions can include (e.g., in order tosafely land the aircraft, such as at an emergency landing location):deploying the parachute in a first parachute anchoring mode; determininga parachute mode transition trigger (e.g., after deploying the parachutein the parachute anchoring mode); and/or controlling the parachute totransition from the parachute anchoring mode to a second parachuteanchoring mode different from the parachute anchoring mode (e.g., inresponse to determining the parachute mode transition trigger).

Determining reactions to aircraft power loss can additionally oralternatively include determining a desired aircraft glide path (and/oraircraft control required to achieve the desired glide path), which caninclude accounting for vehicle state (e.g., airspeed, ground speed,rotor speed, altitude, attitude, heading, weight, center of gravity,damage, etc.), environmental state (e.g.; weather conditions such aswind, precipitation, visibility, and/or turbulence; obstacle conditionssuch as air traffic, trees, buildings, power lines, etc.; groundconditions such as terrain type and/or condition, damage and/or injuryrisks to objects and/or people on land; etc.), safety system state(e.g., availability of one or more backup propulsion mechanisms), and/orany other suitable conditions. The glidepaths can include fully powered,partially powered, and/or unpowered glidepaths (e.g., for deadsticklandings, such as landings associated with autorotation maneuvers,etc.). For example, determining the desired glide path can includedetermining desired use of the backup propulsion mechanism(s), such asto maintain aircraft speed (e.g., and travel as far as possible), gainaltitude (e.g., while maintaining airspeed, while increasing airspeed,while decreasing airspeed, etc.), alter aircraft heading (e.g.,directing the aircraft toward a desired landing location) and/or reduceaircraft bank and/or load factor (e.g., for aircraft performing a bankedturn during primary power loss, after a banked turn performed using thebackup propulsion mechanism, etc.), and/or alter aircraft trajectoryand/or attitude in any other suitable manner. This can, for example,enable the aircraft to reach a desired landing location (e.g., landinglocation that the aircraft could not reach without use of the propulsionmechanism), such as shown in FIG. 8B, and/or can reduce the need toperform significant banking while the aircraft is unpowered, which canbe undesirable (e.g., due to significantly increased stall speed at highbank angles). Determining reactions to aircraft power loss canadditionally or alternatively include determining a reaction forperforming an emergency landing under power (e.g., using an auxiliarypower unit and/or any other suitable backup propulsion mechanism, suchas if the auxiliary power unit can provide sufficient power to completesuch a landing). The auxiliary power unit(s) can include temporarybackup powerplants (e.g., powerplants able to provide propulsion and/orother power for only a limited period of time), such as motors (e.g.,electric motors) configured to rotate the rotor(s), preferably the mainrotor, retrorockets configured to propel the aircraft, and/or any othersuitable powerplants.

Determining reactions to aircraft power loss can additionally oralternatively include determining desired usage of auxiliary power(e.g., prioritizing aircraft systems to power using the auxiliary powerunit). In a first variation (e.g., in which the vehicle is already in asafe region of the height-velocity curve, is oriented substantiallytoward a desired landing location, and can safely reach the desiredlanding location by gliding without power), the auxiliary power may notbe used to power a propulsion mechanism. For example, the auxiliarypower can be conserved (e.g., allowing a later powered reaction inresponse to a change of flight conditions, such as detection of anobstacle with which the aircraft may collide), and/or can be used topower avionics (e.g., non-critical avionics, such as additionalsensors), thereby increasing confidence of the state estimation. In asecond variation (e.g., in which significant power is required toachieve acceptable flight conditions, such as to intercept a glide pathto an acceptable landing location), power provided to non-criticalavionics may be reduced or eliminated, so that additional power can beprovided to the backup propulsion mechanism. However, auxiliary powercan additionally or alternatively be allocated in any other suitablemanner.

S620 can additionally or alternatively include determining reactions toimminent aircraft collisions (e.g., terrain collisions) and/orundesirably abrupt landings (e.g., during emergency landing, such aslandings necessitated by aircraft power loss), such as determiningaircraft landing strategies that may improve expected outcomes foraircraft occupants and/or cargo. Such strategies can include alteringthe aircraft approach and/or flight profile to increase (e.g., maximize)the crumple zone and/or energy dissipation through the aircraftstructure (e.g., crumple zone) and/or safety components, such as bycausing the tail to impact first, which may reduce the impulseexperienced by the occupants and/or cargo. Such strategies canadditionally or alternatively include directing aircraft landing towardcompliant landing locations (e.g., locations with accumulations ofcompliant materials, such as snow and/or pigsty). However, S620 canadditionally or alternatively include determining any other suitablereaction(s) to aircraft power loss and/or imminent collision.

S620 can optionally include determining reactions to undesiredconditions while the aircraft is not in flight. For example, when theaircraft is on (or within a safe threshold distance of) the ground, S620can include determining a rotor seizing reaction (e.g., catastrophicrapid shutdown, such as by use of a crumpling brake fixture) that can beemployed in response to determination of potential rotor collision(e.g., as described above regarding the safety systems). However, S620can additionally or alternatively include determining any other suitablereaction(s) to any other conditions (e.g., undesired conditions).

6.3 Detecting Undesired Flight Conditions.

Detecting undesired flight conditions S630 preferably functions todetect developing flight conditions that may be problematic (e.g.,undesired flight conditions as described above regarding S620), therebyenabling timely and appropriate responses to such flight conditions.Flight conditions can be determined based on the current aircraft and/orenvironmental status (e.g., as described above regarding S620), and/orbased on any other suitable information. Undesired flight conditions canbe detected as described above regarding S330 (e.g., as part or all ofperformance of S330, concurrent with performance of S330, etc.) and/orin any other suitable manner.

Undesired flight conditions are preferably detected during the course ofdetermining flight conditions (e.g., for use in and/or as part ofperforming S620). Flight conditions can be determined (e.g., duringaircraft flight) continuously, periodically, sporadically, in responseto occurrence of a trigger (e.g., extreme value, other aircraftconditions determination, receiving a human input trigger, etc.), and/orwith any other suitable timing. Flight conditions are preferablydetermined on-board the aircraft (e.g., by one or more on-boardprocessors, such as the processors that perform S620 and/or differentprocessors), but can additionally or alternatively be determinedremotely (e.g., by a remote processing system, such as based on inputstransmitted from the aircraft to the remote processing system, whereinthe determinations are subsequently transmitted to the aircraft).

Flight conditions can be determined using machine learning and/orstatistical techniques, heuristic techniques, based on human inputs(e.g., operator assessments of flight conditions), stochastictechniques, deterministic techniques, and/or in any other suitablemanner. S630 can optionally include determining (e.g., associated with aspecific flight condition determined in S630, associated with theoverall status of the aircraft, etc.) one or more: confidence values(e.g., likelihood that the flight condition determination and/or sourceinformation is correct), qualitative and/or quantitative assessments(e.g., of a characteristic of the determined flight condition(s), suchas risk; determined by a regression and/or classification technique,aircraft dynamics calculation, fuel consumption calculation, riskassessment calculation, etc.), and/or any other suitable aircraft statuscharacterizations. However, the flight condition severity canadditionally or alternatively be determined in any other suitable manner(or not be determined).

S630 preferably includes detecting an undesired flight condition forwhich contingency planning has been performed in S620 (e.g., for which areaction has been determined). However, the conditions determined inS630 can additionally or alternatively include any other suitable flightconditions, and/or S630 can additionally or alternatively includedetecting undesired flight conditions in any other suitable manner.

6.4 Reacting to Undesired Flight Conditions.

Reacting to undesired flight conditions S640 preferably functions toimprove outcomes arising from the undesired conditions (e.g., correctthe undesired flight conditions, minimize damage and/or injury caused bythe conditions, etc.). S640 can be performed in response to detecting anundesired flight condition S630, preferably immediately (e.g., innear-real time), but can additionally or alternatively be performed atany other suitable time. S640 can include implementing the reaction(s)determined in S620 (e.g., the optimal reaction for the detected flightcondition), preferably by controlling the aircraft to perform thereactions (e.g., operating the vehicle as described above regardingS610), and can additionally or alternatively include dynamicallyreallocating electrical and/or computational resources to differentprocesses, and/or reacting in any other suitable manner. Reacting toundesired flight conditions S640 can be performed as described above(e.g., regarding S340 and/or S450, such as part or all of performance ofS340 and/or S450, concurrent with performance of S340 and/or S450, etc.)and/or in any other suitable manner.

S640 can optionally include engaging in communication regarding theundesired flight conditions, such as communicating with elements of thecontrol architecture (e.g., mission planner, mission executor, etc.); aremote control entity (e.g., ground station network); an onboard orremote pilot, operator, and/or passenger; a control authority such asATC; other aircraft (e.g., nearby aircraft); and/or any other suitableentities.

In a first embodiment, S640 includes communicating the flight conditions(e.g., existence of the undesired flight conditions) and/or thecorrective actions taken in response (e.g., communicating forinformational purposes). In a second embodiment, S640 includessuggesting and/or requesting (e.g., to one or more humans, such as apilot, passenger, remote operator, etc.) that corrective action betaken. For example, S640 can include generating an alert output (e.g.,auditory output such as a klaxon, ‘ding’, and/or spoken alert; visualoutput such as a flashing alarm, indicator light, and/or display screenmessage; tactile output such as a stick shaker; etc.) in response todetermining undesired flight conditions, which may prompt the operatorto take corrective action. The alert output can be indicative of theaircraft conditions (e.g., “altitude below flight plan” or “altitude is3200 feet”) and/or the suggested corrective actions (e.g., “pull up” or“climb and maintain 5000 feet”), but can additionally or alternativelybe indicative of any other suitable information. One variation of thisembodiment includes, in response to detecting an undesired aircraftcondition: presenting an alert to an operator, informing the operator ofthe undesired condition and/or the determined reaction; receivingconfirmation (e.g., approval of the corrective actions, absence ofdenial of the corrective actions for a threshold period of time, etc.)from the operator; and, in response to receiving the confirmation,controlling the aircraft according to the corrective actions. A secondvariation of this embodiment includes providing recommendations (e.g.,to perform actions, such as actions that the vehicle cannot performautonomously) to one or more vehicle occupants. In examples, therecommended actions can include: open aircraft doors prior to emergencylanding; perform maintenance and/or mechanical tasks (e.g. manuallydeploy or retract landing gear, such as if an autonomous landing gearactuator has failed); fasten seatbelt; adjust seat location (e.g., tomodify vehicle center of gravity); and/or brace for impact (e.g., incase of an emergency landing).

The method can include continuing to assess conditions (e.g., aircraftstate) during performance of S640, preferably determining desiredaircraft operation and/or planned reactions based on the additionalinformation (e.g., modifying plans based on changing conditions). In oneexample (e.g., during performance of S640), in response to detecting asignificant, unexpected change in flight conditions (e.g., detecting apossible collision, such as with a previously-undetected obstacle),power and/or computational resources can be allocated to rapidlyassessing the flight conditions (e.g., collecting additional data fromsensors, computationally analyzing collected data, etc.) and/ordetermining appropriate reactions to the current conditions (e.g., asdescribed above, such as regarding S620). S640 can be iteratively (e.g.,continuously, periodically, etc.) performed based on new, real-time data(e.g., state data, sensor data) during a current instance of S640performance, be performed a single time (wherein the assessed conditionscan be used in future flight sessions), and/or be performed any suitablenumber of iterations at any suitable time. However, the method canadditionally or alternatively include any other suitable elementsperformed in any suitable manner.

7. Safety Corridor

As described above and/or shown in the schematic of FIG. 4, embodimentsof the system and/or method can be associated with or otherwise informalgorithms associated with a method 7 for defining a safety corridorthrough which the vehicle can traverse, preferably based on one or moredata sources (e.g., data sources as described below, such as safetyinformation associated with one or more regions of space, preferablycontiguous regions, from which the safety corridor will be selected),such as statuses of systems of the vehicle in relation to externalfactors (e.g., associated with weather, associated with terrain,associated with traffic, associated with noise, associated withdisturbance of populations within range of the vehicle, etc.).Algorithms associated with determination of the safety corridor canadditionally include continuous determination of safe landing zones(e.g., in relation to emergency landings) for the vehicle as the vehicleproceeds along an intended trajectory (e.g., flight path) in anenvironment.

Generation of the safety corridor is preferably implemented in real timeor near real time, such that boundaries of the corridor and otherguidance logic aspects are continuously/dynamically updated as thevehicle (e.g., aircraft) moves in an environment. Generation of thesafety corridor can be performed during pre-flight phases of operation,during flight phases of operation, and/or during post-flight phases ofoperation (e.g., in relation to evaluation of actual flight data foroptimization of safety corridor generating algorithms). Furthermore,dynamic determination of the safety corridor can be implemented forglobal path optimization (e.g., for complete definition of a safetycorridor) and/or local path optimization (e.g., for definition of anoptimized sub-corridor within a full safety corridor).

The method 7 can utilize data sources indicated above (e.g., withrespect to elements of the method embodiments 3, 4, and/or 6, such assampling inputs S310 and/or S410, determining aircraft conditions S330,determining correlations S320, determining input reliability S430,determining guidance S440, determining expected input characteristicsS420, planning for contingencies S620, and/or detecting undesired flightconditions S630, etc.; example shown in FIG. 11), such as in order toextract data through defined interfaces with data sources. Additionallyor alternatively, data streams and/or sources associated with generationof the corridor can include data sources such as those described belowand/or any other suitable information.

Preferably, as described above, the vehicle(s) associated with themethod 7 comprise aircraft (e.g., rotorcraft, fixed wing aircraft,etc.); however, the method 7 can additionally or alternatively includeor otherwise be associated with non-aircraft vehicles.

The method 7 can include (e.g., based on the data, such as in responseto receipt of the data, preferably in near-real time following receiptbut additionally or alternatively with any other suitable timing)generation of a corridor in space S710 through which the vehicle cantraverse safely, based on analysis of factors derived from the datastreams discussed above. In particular, the data streams can beprocessed to produce factors of interest associated with each orcombination of data streams, which can then be used to governmorphological aspects of the corridor in space dynamically (e.g., overtime, in relation to changing conditions, etc.). As indicated above, thedata associated with external factors and vehicle factors (e.g.,performance and failure modes) can be used to continuously generatelanding zone options (e.g., for emergency landings), such that thevehicle always has a landing zone option through every phase of travel.Each factor derived from the data stream(s) can have an associatedweight or prioritization. For example, factors associated with weatherconditions or terrain conditions can be weighted more heavily thanfactors associated with vehicle noise in relation to proximity tonoise-sensitive populations. Furthermore, for each factor derived fromthe data stream(s), a threshold can be set to increase or decreasesafety margins associated with the corridor generated.

The corridor can be a three dimensional corridor in space, or canalternatively be a two-dimensional or one-dimensional corridor. Thecorridor can be referenced to the vehicle, and in specific examples, canbe centered about vehicle, not centered about vehicle, or otherwisedisplaced from vehicle in any other suitable manner. Block S710 caninclude generation of multiple corridors in space for the vehicle,thereby providing the vehicle with multiple options for safe travel. Forinstance, if a first corridor through which the vehicle is traveling hasa lower safety factor than a second corridor that is also appropriatefor the vehicle (e.g., in terms of vehicle specifications, in terms ofenvironmental conditions, etc.), then the method 7 can include promotingtransitioning the vehicle from the first corridor to the second corridor(e.g., autonomously, through a notification to an operator, etc.). Assuch, as described above, Block S310 can include identification of anoptimal “sub-corridor” or lane within the safety corridor, and caninclude generation of control instructions for the vehicle to transitiontoward the optimal sub-corridor.

In relation to a first corridor generated for a first vehicle, datagenerated from the first vehicle traveling within the first corridor canbe used to adjust a second corridor for a second vehicle travelingwithin a related or otherwise overlapping corridor. For instance, if afirst aircraft experiences unexpected turbulence within the firstcorridor, data (e.g., motion data) from the first aircraft can be usedto trigger an adjustment to the second corridor for the second aircraftthat would otherwise have traveled through the region of unexpectedturbulence. In other variations, other weather, traffic, terrain, orother factors determined from vehicles and their respective corridorscan be used to adjust, in near-real time, corridors for other vehicles.

In some embodiments, the safety corridor can include takeoff- and/orlanding-specific regions (e.g., regions excluded from the safetycorridor, except when undergoing a takeoff or landing maneuver). Forexample, a region near a landing location (e.g., emergency landinglocation, dedicated landing location, etc.) can be excluded from thesafety corridor during normal flight, but can be included in the safetycorridor in response to guidance associated with landing at the landinglocation. However, the safety corridor can additionally or alternativelyinclude and/or exclude any other suitable regions.

In relation to receiving vehicle control inputs (e.g., from an onboarduser), as described above, the method 7 can include processing anyuser-provided control inputs with respect to a generated safetycorridor. In one application, the safety corridor(s) generated can beused to provide boundaries beyond which the vehicle cannot pass inresponse to a control input provided by a user. Additionally oralternatively, in other applications, in response to a control inputprovided by a user, a corridor can be morphologically tightened (e.g.,to have smaller dimensions), thereby increasing safety marginsassociated with the corridor and limiting user control. Additionally oralternatively, in other applications, in response to a control inputprovided by a user, a corridor can be otherwise morphologically adjustedin any other suitable manner in response to the control input.

8. Data Sources.

Data sources associated with reaction determination and/or evaluation(e.g., as described above regarding S620), safety corridor determination(e.g., as described above regarding the safety corridor), and/or anyother suitable elements of the method can optionally include datasources associated with vehicle subsystem statuses (e.g., failurestatuses, standby statuses, inactive statuses, normal statuses, etc.)generated from an on-board diagnostic (OBD) system or other system,wherein the data sources can be associated with mechanical systems,avionic systems, powerplant systems, control surface configurations,fuel status (e.g., fuel and/or fuel reserve quantity; rate ofconsumption, such as faster fuel consumption than expected; etc.),and/or any other suitable systems. As such, potential failure modes ofthe vehicle can be used to determine and/or evaluate reactions.Additionally or alternatively, the data sources can include performancedata (e.g., in relation to operational ceilings, glide slope indifferent configurations, power settings, etc.).

Additionally or alternatively, the data sources can include weatherdata, such as: data extracted from National aviation weather sources;extracted from pilot reports and/or any other suitable informationreceived from other pilots and/or aircraft (e.g., direct radiotransmission from other aircraft; information shared via intermediaries,such as ground stations and/or ATC; etc.), such as descriptions ofcurrent, previous, and/or expected weather conditions; fromradar-associated weather data; from ground-based systems (e.g.,ground-based sensor systems associated with Meteorological TerminalAviation Routine reports, from Terminal Aerodrome forecasts, from AreaForecasts, from Model Output Statistical Forecasts, etc.); fromsatellite systems; from ceilometer devices; and/or from any othersuitable source. Additionally or alternatively, the data sources caninclude data sources associated with altitude and/or environmentalconditions at altitude. Such data sources can be used to define weatherceiling associated limits of operation, icing-related levels ofoperation, regions associated with turbulence/storms, regions associatedwith low-visibility, winds aloft information, and/or any other suitableregions associated with safe boundaries of aircraft travel. In aspecific example, reports (e.g., from other aircraft and/or aircraftoccupants) of turbulence and/or clear conditions in one or more regionscan be used to inform reaction determination and/or evaluation (e.g.,regarding travel through and/or avoidance of the regions).

Additionally or alternatively, the data sources can include radiocommunication data (e.g., in relation to traffic information, inrelation to weather information delivered through radio communications,in relation to TIS-B sources, in relation to FIS-B sources, etc.)extracted from communication audio feeds and processed (e.g., manually,using natural language processing techniques, etc.) to determineinformation relevant for reaction determination and/or evaluation.

Additionally or alternatively, the data sources can include data sourcesassociated with terrain risk profiles extracted from terrain data. Suchdata can further be combined with weather data information (e.g.,current information, historical information) described above, forinstance, using sensor fusion methods, in order to characterize terrainconditions. In variations, terrain and weather data sources can be usedto characterize ground conditions associated with one or more of: groundsaturation (e.g., where a certain range of ground saturation characterwould be preferable for rotorcraft, and another range of groundsaturation character would be preferable for fixed-wing aircraft, etc.),ground hardness, ground vegetation, ground slope, and/or any othersuitable ground conditions within a defined region of interest (e.g.,associated with potential landing sites, such as emergency landingsites). For example, ground saturation (e.g., a ground saturation stateassociated with a location) can be determined based on directmeasurements (e.g., saturation measurements, mechanical measurements,optical measurements, etc.) and/or can be determined (e.g., predicted)based on weather (e.g., current and/or previous weather conditions)and/or historical information (e.g., previous ground saturationcharacterizations). In a specific example, based on a high amount ofrainfall in the past week, a swampy region can be predicted to have highground saturation. However, terrain conditions can additionally oralternatively be determined in any other suitable manner.

Additionally or alternatively, the data sources can include data sourcesassociated with interaction with (e.g., disturbance of) populationswithin range of the vehicle (e.g., in relation to detection of presenceof the aircraft, in relation to disturbances caused by aircraft noise,in relation to ground noise, etc.), wherein such data sources can beextracted from one or more of: records of noise complaints associatedwith aircraft for a particular geographic location, records associatedwith aircraft operation interference (e.g., targeting aircraft withweapons, targeting aircraft with laser pointers, etc.) for a particulargeographic location, flight operation rules over congested areas, and/orany other suitable data source. Such data sources can additionally oralternatively include information associated with ground traffic (e.g.,congestion of nearby roads), gatherings of people and/or property (e.g.,associated with a special event), and/or any other suitable factorsassociated with aircraft interaction with nearby terrestrial entities.

Additionally or alternatively, the data sources can include data sourcesassociated with ground-or other based radar systems (e.g., from airtraffic control sources), with extraction of traffic information (e.g.,vectors/headings, altitudes, climb rates, descent rates, destination,traffic type, etc.) from radar systems. Additionally or alternatively,data sources associated with generation of the corridor can include datasources from traffic collision avoidance systems (and/or other systemsindependent of ground-based systems) associated with or not associatedwith automatic dependent surveillance-broadcast (ADS-B) systems (i.e.,ADS-B in equipment, ADS-B out equipment, etc.), wherein data associatedwith traffic advisories, resolution advisories, and clear of conflictstates can be used to determine and/or evaluate reactions. For instance,such data sources can be used for eliminating or otherwise reducingprobabilities of collision between different categories of aircraft(e.g., in relation to speed and/or size of other aircraft), and/oreliminating or otherwise reducing probabilities of activating TCASsystems of other aircraft for which traffic avoidance operations wouldbe costly (e.g., in relation to time costs, in relation to fuel costs,etc.). Such data sources can additionally or alternatively be used toprevent aircraft from being subject to wake turbulence of otheraircraft, in order to promote smoother flight operations and/or reducerisk of loss of aircraft control due to wake turbulence.

Additionally or alternatively, the data sources can include data sourcesassociated with obstacles (e.g., fixed obstacles, moving and/or moveableobstacles, temporary obstacles, permanent obstacles, etc.). Suchobstacles can include, for example, towers, bridges, buildings, overheadlines (e.g., power lines, data lines, etc.), construction equipment(e.g., cranes, scaffolding, pits, etc.), rubble, vehicles, and/or anyother suitable obstacles. Obstacle information (and/or any othersuitable information) can be determined based on current and/orprevious: sensor measurements (e.g., aerial vehicle sensors, terrestrialsensors, sensors of other aircraft, etc.), human observations (e.g.,aerial vehicle occupant, such as pilots, crew, and/or passengers;occupants of other aircraft; terrestrial observers; ground operators;air traffic controllers; etc.), construction and/or maintenancedocumentation (e.g., construction permits, maintenance reports, worklogs, obstacle construction reports and/or maps, etc.), historicalinformation, and/or any other suitable information sources. For example,in response to detecting new power lines in a location (e.g., detectedby the aerial vehicle, another vehicle operated by the same entity, andindependent vehicle, a human observer, etc.), information associatedwith the power lines is preferably stored (e.g., added to a map, notedin an emergency landing location database, etc.) and/or communicated(e.g., sent to all network vehicles as a hazard report). Thus, duringthe current aerial vehicle trip and/or in future trips, the presence ofthe new power lines can be accounted for (e.g., avoiding glide pathsthat would intersect or come within a threshold distance of the reportedand/or detected power line location).

Any or all data sources can be sampled by, received from, and/orotherwise determined based on current and/or previous: sensormeasurements (e.g., aerial vehicle sensors, terrestrial sensors, sensorsof other aircraft, etc.), human observations (e.g., aerial vehicleoccupant, such as pilots, crew, and/or passengers; occupants of otheraircraft; terrestrial observers; ground operators; air trafficcontrollers; etc.), and/or any other suitable sources of information.Reaction determination and/or evaluation can additionally oralternatively be performed based on any other suitable information, andthe data sources described herein (and any other suitable information)can additionally or alternatively be used for performance of any othersuitable elements of the method.

9. Example Aircraft Control Architecture.

One example of a control architecture (e.g., capable of implementing themethod) for the aircraft includes a planning section (e.g., internalsection) and an execution section (e.g., outward-facing section), andcan interface with autopilot mechanisms, sensors, users, externalinformation sources, and/or any other suitable elements, such as shownin FIG. 9.

The planning section can include a mission planner, a contingencymanager, and/or any other suitable elements. The mission planner canaccept non-emergency inputs (e.g., from one or more users, from a stateestimator of the execution section, etc.) and/or provide mission planinformation to the contingency manager. The contingency manager canaccept emergency inputs (e.g., from the users, state estimator, etc.)and/or provide (e.g., propose, command, etc.) mission modifications tothe mission planner. The planning section preferably interfaces with theexecution section, such as by providing a mission plan (and/ormodifications thereto) to be executed, requesting information, and/orreceiving state estimations and/or information about missionperformance.

The execution section can include a state estimator, a mission executor,and/or any other suitable elements. The state estimator preferably:consumes input information from sensors, users, and/or external sources(e.g., ATC, weather information sources, ground station network, otheraircraft, etc.); determines (e.g., estimates) present conditions (e.g.,aircraft state, other flight conditions, etc.), such as described above(e.g., regarding S630); and outputs information (e.g., associated withthe state estimations) to the mission executor, autopilot, and/or anyother suitable information consumers. The mission executor preferablycommands and/or performs the mission determined and/or provided by theplanning section (e.g., under nominal conditions, by the missionplanner; under off-nominal conditions, by the contingency manager). Themission executor preferably consumes state information (e.g., from thestate estimator) and commands setpoints for the autopilot mechanism. Themission executor is preferably vehicle-independent (e.g., can be usedwith an arbitrary vehicle or arbitrary vehicle of a particular type,such as aircraft or rotorcraft), and is preferably used to control avehicle-specific autopilot mechanism. For example, the autopilotmechanism can consume setpoints (e.g., altitude, heading, waypoints,route lines, speed, etc.) and control actuation of aircraft systems(e.g., flight control surfaces, power plants, etc.) in response toreceiving the setpoints.

However, the aircraft can additionally or alternatively include anyother suitable control architecture (e.g., implementing the method), orinclude no such control architecture.

An alternative embodiment preferably implements the some or all of abovemethods in a computer-readable medium storing computer-readableinstructions. The instructions are preferably executed bycomputer-executable components preferably integrated with acommunication routing system. The communication routing system mayinclude a communication system, routing system and a pricing system. Thecomputer-readable medium may be stored on any suitable computer readablemedia such as RAMs, ROMs, flash memory, EEPROMs, optical devices (CD orDVD), hard drives, floppy drives, or any suitable device. Thecomputer-executable component is preferably a processor but theinstructions may alternatively or additionally be executed by anysuitable dedicated hardware device.

Although omitted for conciseness, embodiments of the system and/ormethod can include every combination and permutation of the varioussystem components and the various method processes, wherein one or moreinstances of the method and/or processes described herein can beperformed asynchronously (e.g., sequentially), concurrently (e.g., inparallel), or in any other suitable order by and/or using one or moreinstances of the systems, elements, and/or entities described herein.Herein, “substantially” can be within a predetermined error margin(e.g., 0.1%, 0.5%, 1%, 2%, 3%, 5%, 10%, 15%, etc.) and/or confidenceinterval (e.g., 99.9%, 99.5%, 99%, 98%, 97%, 95%, 90%, 85%, 80%, 75%,65%, 50%, etc.) of the referenced value (e.g., predetermined pattern,propulsion characteristics, route, time, numerical value, location,etc.).

The FIGURES illustrate the architecture, functionality and operation ofpossible implementations of systems, methods and computer programproducts according to preferred embodiments, example configurations, andvariations thereof. In this regard, each block in the flowchart or blockdiagrams may represent a module, segment, step, or portion of code,which comprises one or more executable instructions for implementing thespecified logical function(s). It should also be noted that, in somealternative implementations, the functions noted in the block can occurout of the order noted in the FIGURES. For example, two blocks shown insuccession may, in fact, be executed substantially concurrently, or theblocks may sometimes be executed in the reverse order, depending uponthe functionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts, or combinations of special purpose hardware andcomputer instructions.

As a person skilled in the art will recognize from the previous detaileddescription and from the figures and claims, modifications and changescan be made to the preferred embodiments of the invention withoutdeparting from the scope of this invention defined in the followingclaims.

We claim:
 1. A method of aircraft operation, comprising: flying anaircraft in a normal flight mode, comprising: at a first sensor of theaircraft, sampling a first set of flight data; and at a processor of theaircraft, autonomously controlling the aircraft to fly based on thefirst set of flight data; while flying the aircraft in the normal flightmode, sampling a dataset at a second sensor of the aircraft, the datasetindicative of an undesired condition associated with a flight controlelement of the aircraft; determining that the first set of flight datais consistent with the undesired condition; based on the dataset,determining that the flight control element is in the undesiredcondition; and in response to determining that the flight controlelement is in the undesired condition and determining that the first setof flight data is consistent with the undesired condition, landing theaircraft, comprising: determining an emergency landing location; at thefirst sensor, sampling a second set of flight data; and at theprocessor, autonomously controlling the aircraft to land at theemergency landing location based on the second set of flight data. 2.The method of claim 1, wherein the aircraft contains a living human. 3.The method of claim 2, wherein the aircraft does not contain and doesnot receive control inputs from a licensed pilot.
 4. The method of claim1, wherein: the first set of flight data is indicative of an undesiredaircraft trajectory; the flight control element is a flight controlsurface; the second sensor is a flight control surface position sensorassociated with the flight control surface; and the undesired conditionis associated with an actuation failure of the flight control surface.5. The method of claim 4, wherein the second sensor comprises a camera.6. The method of claim 4, wherein the second sensor comprises atime-of-flight sensor.
 7. The method of claim 4, wherein: the actuationfailure causes a directional bias during aircraft flight; and theemergency landing location is determined based on the directional bias.8. The method of claim 1, wherein: the aircraft is a rotorcraft; theundesired condition comprises failure of a propulsion mechanism of theaircraft; and autonomously controlling the aircraft to land at theemergency landing location comprises autonomously controlling theaircraft to perform an autorotation maneuver.
 9. The method of claim 1,wherein: the aircraft comprises an airframe, a rotor rotationallycoupled to the airframe about a rotor axis, and a parachute mechanicallycoupled to the airframe; and autonomously controlling the aircraft toland at the emergency landing location comprises deploying the parachutein a parachute anchoring mode.
 10. The method of claim 9, whereinautonomously controlling the aircraft to land at the emergency landinglocation further comprises: after deploying the parachute in theparachute anchoring mode, determining a parachute mode transitiontrigger; and in response to determining the parachute mode transitiontrigger, controlling the parachute to transition from the parachuteanchoring mode to a second parachute anchoring mode different from theparachute anchoring mode.
 11. A method of aircraft operation,comprising: autonomously flying an aircraft in a normal flight mode;while autonomously flying the aircraft in the normal flight mode:sampling a first dataset at a first sensor of a first sensor type, thefirst dataset indicative of an undesired condition associated with aflight control element of the aircraft; and sampling a second dataset ata second sensor of a second sensor type different than the first sensortype, the second dataset indicative of the undesired condition; based onthe first and second datasets, determining that the flight controlelement is in the undesired condition; and in response to determiningthat the flight control element is in the undesired condition, flyingthe aircraft in a modified mode, comprising: sampling a set of flightdata; at a processor of the aircraft, determining a modified flight planbased on the undesired condition; and at the processor, autonomouslycontrolling the aircraft to fly based on the modified flight plan andthe set of flight data.
 12. The method of claim 11, wherein: theundesired condition comprises an undesired vibration; the first sensoris an audio sensor; and the first dataset comprises audio dataindicative of the undesired vibration.
 13. The method of claim 12,wherein the second sensor is an accelerometer.
 14. The method of claim12, wherein: the aircraft is a rotorcraft comprising a rotor; and theundesired vibration is associated with the rotor.
 15. The method ofclaim 12, wherein the undesired vibration is associated with astructural member of the aircraft.
 16. The method of claim 11, wherein:determining the modified flight plan comprises determining an emergencylanding location; and autonomously controlling the aircraft to fly basedon the modified flight plan and the set of flight data comprisesautonomously controlling the aircraft to land at the emergency landinglocation based on the set of flight data.
 17. The method of claim 16,wherein: the aircraft is a rotorcraft; and autonomously controlling theaircraft to land at the emergency landing location comprisesautonomously controlling the aircraft to perform an autorotationmaneuver.
 18. The method of claim 11, wherein the aircraft contains aliving human.
 19. The method of claim 11, wherein: autonomously flyingthe aircraft in the normal flight mode comprises autonomously flying theaircraft based on a flight plan associated with a planned destination;determining the modified flight plan comprises determining a modifieddestination different than the planned destination; and autonomouslycontrolling the aircraft to fly based on the modified flight plan andthe set of flight data comprises autonomously controlling the aircraftto land at the modified destination.
 20. The method of claim 11,wherein: autonomously flying the aircraft in the normal flight modecomprises flying the aircraft at a first speed; and the modified mode isa conservative mode, wherein, while flying the aircraft in theconservative mode, the aircraft does not exceed a second speed less thanthe first speed.